Pimcore 反序列化漏洞（CVE-2026-0520）修复与白名单加固

漏洞概述 漏洞名称：Pimcore HotspotImage 中 对 object-store 列的无限制反序列化（PHP 对象注入，CWE-502） CVE 编号：CVE-2026-0520 严重等级：高（High） 漏洞描述： 在读取 object-store 列时，直接调用 ，未传入 白名单，导致攻击者可通过写入序列化字节触发任意对象反序列化，进而实现远程代码执行（RCE）。 影响范围 受影响组件： - 中的 方法 - 根因： 中 默认 （即无白名单限制） 受影响版本： - （Composer） - 受影响版本： 、 、 补丁版本： - 、 、 影响说明：攻击者若能向 列写入序列化数据（如通过 SQL 写入原语），即可触发反序列化，利用 Pimcore 依赖中的 gadget chain 实现 RCE。 修复方案 推荐最小修复：在 中调用 时显式传入 白名单，例如： 替代方案：将 的默认 从 改为 ，并更新所有调用方以显式传入白名单。 POC 代码 ```php addOption('benign', null, InputOption::VALUE_NONE, 'negative control: benign JSON'); $this->addOption('restricted', null, InputOption::VALUE_NONE, 'negative control: allowed_classes=false'); } protected function execute(InputInterface $input, OutputInterface $output): int { $target = $input->getOption('target'); $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

Pimcore 反序列化漏洞（CVE-2026-0520）修复与白名单加固

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

Pimcore 反序列化漏洞（CVE-2026-0520）修复与白名单加固

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！