LoginSign Up
← Back to all sparks
P

Pimcore

MKT AUTO
Velocity5.0

Open-source data and experience management platform (PIM, MDM, DAM, CMS)

pimcore.com ↗

Pimcore 2026.3.3.1 tightens the Twig sandbox again, two days after 2026.3.3.

pimdamsecurity-patchphpopen-source
◆Current state
Pimcore's 2026.3 line is in a security-heavy patch cycle: 2026.3.3.1 restricts what the Twig sandbox can reach (the request object and pimcore_dump), two days after 2026.3.3 fixed a Custom Reports SQL-denylist bypass and object injection. 2026.3.2 had already patched an earlier Twig sandbox bypass.
◆Where it's heading
Every 2026.3 patch since 2026.3.1 has carried security fixes, and the Twig sandbox has now been hardened twice. Feature work has paused after the 2026.3.0 workflow extension slots, and the weekly patches are going to template and reporting surfaces that admins expose to editors.
◆Prediction
Expect more weekly 2026.3.x patches with advisories on template and reporting surfaces before any 2026.4 feature release.

◆Recent moves

  1. 7d ago

    2026.3.3.1: Twig sandbox can no longer reach request or dump

    A one-fix hotfix that stops Twig templates from reaching the request object and pimcore_dump. It is the second Twig sandbox fix this month, after 2026.3.2, so admins who let editors write templates should take it.

    View source ↗
  2. 9d ago

    2026.3.3: SQL-denylist and unserialize fixes, lighter relations

    The third straight patch with security advisories, here a quote-nesting bypass of the Custom Reports SQL denylist and PHP object injection through session tmp_store data. Alongside sit performance changes, a lightweight ManyToMany loader and skipping unused calculated values, and atomic job counting so the Generic Execution Engine finishes with several workers.

    View source ↗
  3. 16d ago

    Pimcore 2026.3.2 patches IDOR, Twig sandbox bypass and object injection

    The second 2026.3 patch is mostly security: an IDOR that let scheduled version publishing overwrite arbitrary elements, a Twig sandbox bypass enabling file read and delete, unsafe link HTML, and PHP object injection through date properties. It is the second Twig sandbox fix in the window after 2026.2.8, and the advisory count makes this a must-upgrade patch.

    View source ↗
  4. 23d ago

    Pimcore 2026.3.1: per-type version storage, focal-point fixes

    The first 2026.3 patch lets teams store versions in different storage per element type and skip versioning on asset upload. It also sanitizes generated model class descriptions. It continues the storage-flexibility work of recent releases.

    View source ↗
  5. 1mo ago

    Pimcore 2026.3: workflow extension slots and cache/lock tuning

    2026.3.0 adds custom extension slots to workflow places and transitions, coauthor data on versions, and a configurable thumbnail cache lifetime. It is the most extensibility-focused release in the window.

    View source ↗
  6. 1mo ago

    Pimcore 2026.2.14: storage-queue safety fixes

    Fixes stop the storage queue from deleting content a pending move still needs, plus a DBAL 4 collation bug. These are correctness patches that users only notice if they hit them.

    View source ↗