LoginSign Up
← Back to all sparks
P

Pimcore

MKT AUTO
Velocity5.0

Open-source data and experience management platform (PIM, MDM, DAM, CMS)

pimcore.com ↗

Pimcore is shipping a security advisory almost every week.

cmsdxpsecurity-advisoriesphp-symfonydata-objectspatch-cadence
◆Current state
Pimcore releases on a weekly-to-fortnightly patch cadence across two supported lines - 2026.2.x and the older 12.3.x - and the defining feature of the last two months is the volume of security work. Nearly every release carries at least one GHSA: WebDAV rename permissions, ImageGallery hotspot unserialize, Classificationstore field-name validation, blind SSRF via email test-send, Custom Report field allowlisting. Around it sits ordinary bug fixing in workflows, thumbnails, and data object handling.
◆Where it's heading
The advisories are not scattered; they cluster on the surfaces where Pimcore accepts structured input from an authenticated user - custom reports, classification stores, WebDAV, grid configuration. The fixes follow a consistent method of allowlisting fields, enforcing permissions at the operation rather than the screen, and refusing to echo raw database errors. Read together, this is a deliberate audit of the admin surface rather than a run of unrelated reports, and it is being done in public one patch at a time.
◆Prediction
The audit pattern points at the remaining input-accepting admin surfaces - imports, grid and filter parsers, WebDAV operations beyond MOVE - so expect more advisories of the same shape before the cadence slows.

◆Recent moves

  1. 1d ago

    WebDAV MOVE now enforces rename permission

    A GHSA fix requiring rename permission on same-directory WebDAV MOVE, plus workflow marking rolled back when a post-transition save fails, a housekeeping race condition, and two TypeError fixes. The advisory continues the audit of admin surfaces that accept user-controlled operations.

    View source ↗
  2. 7d ago

    Three security advisories close unserialize, Classificationstore, and Twig sandbox holes

    Restricted ImageGallery hotspot unserialize, Classificationstore field-name identifier validation, and a blocked file-extension bypass, alongside a UserProvider fatal error for deleted users. The densest security release in the window.

    View source ↗
  3. 11d ago

    12.3 branch patch: object deserialization and Carbon assertion fixes

    A two-item patch on the older 12.3 line restoring object deserialization for block, editable, and WebDAV delete-log data. Evidence that the legacy branch is still being serviced alongside 2026.2.

    View source ↗
  4. 11d ago

    Bug batch: inheritance precedence, cache sessions, workflow checkboxes

    Inverted inheritance precedence for Classificationstore multiselect values, video processor storage optimization on local storage, and session handling before full page cache hits. A rare patch with no advisory attached.

    View source ↗
  5. 13d ago

    Blind SSRF in email test-send closed; language permissions enforced on grids

    A blind SSRF through the email test-send CSS fetch is closed and Viewable/Editable Languages permissions are enforced for grid configuration. Both are the same pattern: a capability reachable from the admin UI that was not checking authorization.

    View source ↗
  6. 21d ago

    Custom Report locked to a field allowlist; raw DB errors no longer leak

    Custom Report updates restricted to an explicit field allowlist and raw database exception messages no longer returned from column-config. Also adds a code-review skill for detecting backward-compatibility breaks, which is the project tooling its own audit.

    View source ↗