CVE-2026-41249 Details
Description
CoreShop is a Pimcore enhanced eCommerce solution. In versions 5.0.1 through 5.1.0-beta.1,, the GitHub Actions workflow (`.github/workflows/static.yml`) uses the `pull_request_target` trigger but dangerously checks out the unverified code from the pull request head (`ref: ${{ github.event.pull_request.head.ref }}`). Subsequently, it executes a script (`bin/console`) from this untrusted checkout. This allows any external attacker to achieve Remote Code Execution (RCE) on the GitHub Actions runner simply by submitting a malicious Pull Request. Also known as a "Pwn Request" vulnerability. As of time of publication, `pull_request_target` is still in the file.
A remote code execution vulnerability has been identified in CoreShop versions 5.0.1 through 5.1.0-beta.1. The issue arises in the GitHub Actions workflow static.yml, which uses the pull_request_target trigger. This configuration allows unverified code from the pull request head to be checked out and executed, creating a 'Pwn Request' vulnerability. An external attacker can exploit this by submitting a malicious pull request, leading to arbitrary code execution on the GitHub Actions runner.
Users are advised not to check out untrusted pull request code when using the 'pull_request_target' trigger, especially if the code will be executed. Consider using a separate workflow architecture that utilizes the 'workflow_run' event for actions requiring repository secrets.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 4, 2026CISA-ADP
Assessed Jun 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/coreshop/CoreShop/security/advisories/GHSA-q58j-g3f4-h26h | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/coreshop/CoreShop/blob/5.1.0-beta.1/.github/workflows/static.yml#L14 | [email protected] | Source CodeVendor |
| https://github.com/coreshop/CoreShop/commit/cc1e3f547228ec5ebfc1dc0472f9a3cc5f4137a4 | [email protected] | Source CodeVendor |
| https://github.com/coreshop/CoreShop/security/advisories/GHSA-q58j-g3f4-h26h | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CoreShop | >= 5.0.0, <= 5.1.0-beta.1 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 8, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2026 | New CVE Received | [email protected] |