CVE-2026-5362 Details
Description
An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution when the published page is rendered. This issue affects pimcore: v12.3.3.
A stored cross-site scripting vulnerability has been identified in Pimcore version 12.3.3. This issue allows authenticated attackers with permission to edit documents to inject crafted HTML and JavaScript into an embed editable. When the document is published and viewed, the injected script is executed. The vulnerability arises because the embed editable does not properly sanitize URLs before embedding, allowing arbitrary HTML, including scripts, to be executed in the context of the user's browser.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://fluidattacks.com/es/advisories/mago | [email protected] | ExploitThird Party Advisory |
| https://github.com/pimcore/pimcore/ | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pimcore pimcore | 12.3.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | Initial Analysis | [email protected] |
| Apr 27, 2026 | New CVE Received | [email protected] |