CVE-2026-45162 Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction
Attackers can achieve remote code execution in Pimcore by exploiting unsafe PHP deserialization in multiple components without class restrictions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45162?
CVE-2026-45162 is a high-severity unsafe deserialization vulnerability in pimcore, published on 17 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP's unserialize() on data from database columns and filesystem files without the allowed_classes restriction, including lib/Tool/Authentication.php, models/Site/Dao.php, models/DataObject/ClassDefinition/CustomLayout/Dao.php, models/Tool/TmpStore/Dao.php, models/Asset/WebDAV/Service.php, and admin-ui-classic-bundle/src/Helper/Dashboard.php, enabling object injection and remote code execution if an attacker can control the serialized data source. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.
Weakness: CWE-502
Which versions are affected by CVE-2026-45162?
6 open source packages ship an affected version, including pimcore/pimcore.
| Package | Affected | Fixed in |
|---|---|---|
pimcore/pimcore Packagist | All versions | 11.5.17 |
pimcore/pimcore Packagist | All versions | 11.5.17 |
pimcore/pimcore Packagist | From 12.0.0-RC1 | 12.3.7 |
pimcore/pimcore Packagist | From 12.0.0-RC1 | 12.3.7 |
pimcore/pimcore Packagist | From 2026.1.0 | 2026.1.3 |
pimcore/pimcore Packagist | From 2026.1.0 | 2026.1.3 |
How do I fix CVE-2026-45162?
Upgrade pimcore/pimcore to a fixed version for your release line: 11.5.17, 12.3.7 or 2026.1.3.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-45162 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45162 exists.
Sources
Also known as GHSA-36fc-7wjg-mfvj.