CVE-2026-55212High· 7.1▾ Twilight

Pimcore is an Open Source Data & Experience Management Platform

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score39/ 100 · Low

impact 39.1 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jul 9, 2026

Updated

Jul 10, 2026

CVSS

7.1

Vendor

—

Product

—

CWE

CWE-285

Depth score

39 · Low

EPSS

0.35% · p29

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

EPSS history

Exploit-prediction probability, daily snapshots since Jul 11.

0.2% → 0.4%▲ 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 46 days

Jul 9, 2026Published
Disclosed via NVD
Jul 10, 2026Record revised
Last analysed / modified upstream
Jul 11, 2026EPSS first tracked
0.2%
Aug 24, 2026EPSS peak
0.2% → 0.4%

CWE-285 #nvd

Full technical detail▾

Overview

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, the Studio API class definition creation endpoint POST /pimcore-studio/api/class/definition/configuration-view/detail/create is guarded by the objects permission instead of the classes permission, allowing a standard editor-level user to create class definitions without admin privileges. Class definition creation generates new database tables and PHP class files on the server, and missing API-layer UID format validation allows malformed UIDs to reach model-layer validation and return internal exceptions. This issue is fixed in versions 2025.4.6 and 2026.1.6.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed