Pimcore CVE-2026-0520 unserialize RCE vulnerability and whitelist fix

Vulnerability Overview Vulnerability Name: Unrestricted Deserialization of Columns via in Pimcore HotspotImage's (PHP Object Injection, CWE-502) CVE ID: CVE-2026-0520 Severity: High Description: directly calls when reading the object-store column. Since no whitelist is passed, an attacker can write serialized byte strings to trigger arbitrary object deserialization, potentially leading to Remote Code Execution (RCE). Affected Scope Affected Components: - The method in - Root Cause: In , defaults to (i.e., no whitelist restriction). Affected Versions: - (Composer) - Affected versions: , , Patched Versions: - , , Impact: If an attacker can write serialized data into the column (e.g., via a SQL write primitive), they can trigger deserialization and achieve RCE by exploiting gadget chains within Pimcore's dependencies. Remediation Recommended Minimal Fix: Explicitly pass an whitelist when calling within , for example: Alternative: Change the default in from to , and update all callers to explicitly pass a whitelist. Proof of Concept (POC) ```php addOption('benign', null, InputOption::VALUE_NONE, 'negative control: benign JSON'); $this->addOption('restricted', null, InputOption::VALUE_NONE, 'negative control: allowed_classes=false'); } protected function execute(InputInterface $input, OutputInterface $output): int { $target = $input->getOption('target'); $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $target = '/tmp/guzzle_local_src.txt'; $

Goal Reached Thanks to every supporter — we hit 100%!

Pimcore CVE-2026-0520 unserialize RCE vulnerability and whitelist fix

More from this source