CVE-2026-109392 Details

A stored cross-site scripting vulnerability has been identified in Pimcore versions through 2026.3.1. This vulnerability allows authenticated backend users to inject scripts by saving unescaped URLs in ExternalImage fields. Attackers with permission to edit data objects can introduce payloads that execute JavaScript in the admin interface when other users access version preview or diff views.

Immediate remediation involves applying proper HTML escaping to the URLs before they are stored and rendered. This can be done by using htmlspecialchars() with appropriate flags to ensure the URLs are safe for HTML attributes and text. Additionally, a short-term fix could include validating the URLs to allow only intended schemes like 'https:' while rejecting 'javascript:' or 'vbscript:' URLs. For a more robust solution, consider using a safe rendering method that automatically handles escaping, and implement regression tests to ensure the vulnerability does not reoccur.