Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-cbz2-sxrt-rffn
Vulnerability ID VCID-cbz2-sxrt-rffn
Aliases CVE-2026-23493
GHSA-q433-j342-rp9h
Summary Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensitive information such as database passwords, cookie session data, and other details can be accessed or recovered through the Pimcore backend. This vulnerability is fixed in 12.3.1 and 11.5.14.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-532 Insertion of Sensitive Information into Log File
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 1e-05 https://api.first.org/data/v1/epss?cve=CVE-2026-23493
epss 1e-05 https://api.first.org/data/v1/epss?cve=CVE-2026-23493
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-q433-j342-rp9h
cvssv3.1 8.6 https://github.com/pimcore/pimcore
generic_textual HIGH https://github.com/pimcore/pimcore
cvssv3.1 8.6 https://github.com/pimcore/pimcore/commit/002ec7d5f84973819236796e5b314703b58e8601
generic_textual HIGH https://github.com/pimcore/pimcore/commit/002ec7d5f84973819236796e5b314703b58e8601
ssvc Track https://github.com/pimcore/pimcore/commit/002ec7d5f84973819236796e5b314703b58e8601
cvssv3.1 8.6 https://github.com/pimcore/pimcore/pull/18918
generic_textual HIGH https://github.com/pimcore/pimcore/pull/18918
ssvc Track https://github.com/pimcore/pimcore/pull/18918
cvssv3.1 8.6 https://github.com/pimcore/pimcore/releases/tag/v11.5.14
generic_textual HIGH https://github.com/pimcore/pimcore/releases/tag/v11.5.14
ssvc Track https://github.com/pimcore/pimcore/releases/tag/v11.5.14
cvssv3.1 8.6 https://github.com/pimcore/pimcore/releases/tag/v12.3.1
generic_textual HIGH https://github.com/pimcore/pimcore/releases/tag/v12.3.1
ssvc Track https://github.com/pimcore/pimcore/releases/tag/v12.3.1
cvssv3.1 8.6 https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h
cvssv3.1_qr HIGH https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h
generic_textual HIGH https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h
ssvc Track https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h
cvssv3.1 8.6 https://nvd.nist.gov/vuln/detail/CVE-2026-23493
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-23493
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-23493
002ec7d5f84973819236796e5b314703b58e8601 https://github.com/pimcore/pimcore/commit/002ec7d5f84973819236796e5b314703b58e8601
18918 https://github.com/pimcore/pimcore/pull/18918
CVE-2026-23493 https://nvd.nist.gov/vuln/detail/CVE-2026-23493
GHSA-q433-j342-rp9h https://github.com/advisories/GHSA-q433-j342-rp9h
GHSA-q433-j342-rp9h https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h
v11.5.14 https://github.com/pimcore/pimcore/releases/tag/v11.5.14
v12.3.1 https://github.com/pimcore/pimcore/releases/tag/v12.3.1
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L Found at https://github.com/pimcore/pimcore
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L Found at https://github.com/pimcore/pimcore/commit/002ec7d5f84973819236796e5b314703b58e8601
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-15T19:02:04Z/ Found at https://github.com/pimcore/pimcore/commit/002ec7d5f84973819236796e5b314703b58e8601
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L Found at https://github.com/pimcore/pimcore/pull/18918
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-15T19:02:04Z/ Found at https://github.com/pimcore/pimcore/pull/18918
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L Found at https://github.com/pimcore/pimcore/releases/tag/v11.5.14
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-15T19:02:04Z/ Found at https://github.com/pimcore/pimcore/releases/tag/v11.5.14
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L Found at https://github.com/pimcore/pimcore/releases/tag/v12.3.1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-15T19:02:04Z/ Found at https://github.com/pimcore/pimcore/releases/tag/v12.3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L Found at https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-15T19:02:04Z/ Found at https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2026-23493
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 5e-05
EPSS Score 1e-05
Published At June 12, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:41:59.394264+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/23xxx/CVE-2026-23493.json 38.6.0