CVE-2026-23493

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23493", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-13T15:47:41.629Z", "datePublished": "2026-01-15T16:38:23.923Z", "dateUpdated": "2026-01-15T19:02:08.517Z"}, "containers": {"cna": {"title": "Pimcore ENV Variables and Cookie Informations are exposed in http_error_log", "problemTypes": [{"descriptions": [{"cweId": "CWE-532", "lang": "en", "description": "CWE-532: Insertion of Sensitive Information into Log File", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h"}, {"name": "https://github.com/pimcore/pimcore/pull/18918", "tags": ["x_refsource_MISC"], "url": "https://github.com/pimcore/pimcore/pull/18918"}, {"name": "https://github.com/pimcore/pimcore/commit/002ec7d5f84973819236796e5b314703b58e8601", "tags": ["x_refsource_MISC"], "url": "https://github.com/pimcore/pimcore/commit/002ec7d5f84973819236796e5b314703b58e8601"}, {"name": "https://github.com/pimcore/pimcore/releases/tag/v11.5.14", "tags": ["x_refsource_MISC"], "url": "https://github.com/pimcore/pimcore/releases/tag/v11.5.14"}, {"name": "https://github.com/pimcore/pimcore/releases/tag/v12.3.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/pimcore/pimcore/releases/tag/v12.3.1"}], "affected": [{"vendor": "pimcore", "product": "pimcore", "versions": [{"version": ">= 12.0.0-RC1, < 12.3.1", "status": "affected"}, {"version": "< 11.5.14", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-15T16:38:23.923Z"}, "descriptions": [{"lang": "en", "value": "Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensitive information such as database passwords, cookie session data, and other details can be accessed or recovered through the Pimcore backend. This vulnerability is fixed in 12.3.1 and 11.5.14."}], "source": {"advisory": "GHSA-q433-j342-rp9h", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-15T19:02:04.572218Z", "id": "CVE-2026-23493", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T19:02:08.517Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23493", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-15T19:02:04.572218Z"}}}], "references": [{"url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T19:01:55.906Z"}}], "cna": {"title": "Pimcore ENV Variables and Cookie Informations are exposed in http_error_log", "source": {"advisory": "GHSA-q433-j342-rp9h", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "pimcore", "product": "pimcore", "versions": [{"status": "affected", "version": ">= 12.0.0-RC1, < 12.3.1"}, {"status": "affected", "version": "< 11.5.14"}]}], "references": [{"url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h", "name": "https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/pimcore/pimcore/pull/18918", "name": "https://github.com/pimcore/pimcore/pull/18918", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pimcore/pimcore/commit/002ec7d5f84973819236796e5b314703b58e8601", "name": "https://github.com/pimcore/pimcore/commit/002ec7d5f84973819236796e5b314703b58e8601", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pimcore/pimcore/releases/tag/v11.5.14", "name": "https://github.com/pimcore/pimcore/releases/tag/v11.5.14", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pimcore/pimcore/releases/tag/v12.3.1", "name": "https://github.com/pimcore/pimcore/releases/tag/v12.3.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensitive information such as database passwords, cookie session data, and other details can be accessed or recovered through the Pimcore backend. This vulnerability is fixed in 12.3.1 and 11.5.14."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-532", "description": "CWE-532: Insertion of Sensitive Information into Log File"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-15T16:38:23.923Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23493", "state": "PUBLISHED", "dateUpdated": "2026-01-15T19:02:08.517Z", "dateReserved": "2026-01-13T15:47:41.629Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-15T16:38:23.923Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "pimcore", "vendor": "pimcore", "versions": [{"status": "affected", "version": ">= 12.0.0-RC1, < 12.3.1"}, {"status": "affected", "version": "< 11.5.14"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*", "matchCriteriaId": "0B2CDE57-18BF-48B4-A0D7-BA3673CD3016", "versionEndExcluding": "11.5.14", "vulnerable": true}, {"criteria": "cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*", "matchCriteriaId": "FD4D552C-238D-49EC-8F68-19EC520EAD57", "versionEndExcluding": "12.3.1", "versionStartIncluding": "12.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensitive information such as database passwords, cookie session data, and other details can be accessed or recovered through the Pimcore backend. This vulnerability is fixed in 12.3.1 and 11.5.14."}, {"lang": "es", "value": "Pimcore es una Plataforma de Gesti\u00f3n de Datos y Experiencias de C\u00f3digo Abierto. Antes de las versiones 12.3.1 y 11.5.14, el archivo http_error_log almacena las variables $_COOKIE y $_SERVER, lo que significa que informaci\u00f3n sensible como contrase\u00f1as de base de datos, datos de sesi\u00f3n de cookie y otros detalles pueden ser accedidos o recuperados a trav\u00e9s del backend de Pimcore. Esta vulnerabilidad est\u00e1 corregida en las versiones 12.3.1 y 11.5.14."}], "id": "CVE-2026-23493", "lastModified": "2026-06-17T10:21:41.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23493", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-15T19:02:04.572218Z", "version": "2.0.3"}}]}, "published": "2026-01-15T17:16:08.293", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/pimcore/pimcore/commit/002ec7d5f84973819236796e5b314703b58e8601"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/pimcore/pimcore/pull/18918"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/pimcore/pimcore/releases/tag/v11.5.14"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/pimcore/pimcore/releases/tag/v12.3.1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Vendor Advisory"], "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T19:11:29.681814+00:00", "value": {"mitigation_remediation": ["Apply the vendor patch by upgrading to Pimcore 12.3.1 or 11.5.14", "After updating, verify that the server\u2019s logging configuration no longer records environment or superglobal data, and delete any existing logs containing sensitive information", "If an upgrade cannot be performed immediately, restrict file permissions on the http_error_log to deny read access to non\u2011administrator users and consider temporarily disabling detailed error logging until a patch is available"], "summary": {"action": "Patch", "impact": "Log data exposure leading to potential confidentiality compromise via sensitive environment and session information"}, "threat_synthesis": {"affected_systems": "Pimcore data and experience management platform versions prior to 12.3.1 and 11.5.14 are affected. The issue was addressed in the releases 12.3.1 and 11.5.14 and later. All installations using earlier Pimcore releases should be upgraded to at least the corrected versions.", "description_and_impact": "The vulnerability in Pimcore allows the http_error_log file to store the contents of the $_COOKIE and $_SERVER superglobals. These variables can contain sensitive credentials such as database passwords, session tokens, and other confidential data. Exposing them in the error log means that anyone who can read the log file can recover these secrets, effectively compromising both confidentiality and integrity of the application\u2019s environment and user data.", "risk_and_exploitability": "The CVSS score of 8.6 classifies this as a high severity vulnerability, while the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that exploiting the flaw requires an ability to read the http_error_log file, which typically involves elevated privileges on the host or access to the Pimcore backend. An attacker with such access could retrieve environmental and session information, potentially leading to full system compromise."}}}}, "created": "2026-01-16T13:43:41.716143+00:00", "updated": "2026-04-18T19:15:10.615185+00:00", "vendors": ["pimcore", "pimcore$PRODUCT$pimcore"]}