CVE-2026-23493
📋 TL;DR
Pimcore versions before 12.3.1 and 11.5.14 store sensitive information like database passwords and session cookies in the http_error_log file, which can be accessed through the Pimcore backend. This allows attackers to potentially steal credentials and escalate privileges. All Pimcore installations using vulnerable versions are affected.
💻 Affected Systems
- Pimcore
📦 What is this software?
Pimcore by Pimcore
Pimcore by Pimcore
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through stolen database credentials leading to data exfiltration, privilege escalation, and complete control over the Pimcore instance.
Likely Case
Session hijacking and unauthorized access to sensitive data stored in the Pimcore system.
If Mitigated
Limited impact if logs are properly secured and access to the backend is restricted to authorized users only.
🎯 Exploit Status
Exploitation requires access to the Pimcore backend interface, which typically requires authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.3.1 or 11.5.14
Vendor Advisory: https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h
Restart Required: No
Instructions:
1. Backup your Pimcore installation and database. 2. Update to Pimcore 12.3.1 (for v12) or 11.5.14 (for v11). 3. Verify the update completed successfully. 4. Clear any cached data if necessary.
🔧 Temporary Workarounds
Restrict access to http_error_log file
linuxSet proper file permissions to prevent unauthorized access to the log file.
chmod 600 /path/to/pimcore/var/log/http_error.log
chown www-data:www-data /path/to/pimcore/var/log/http_error.log
Disable logging of sensitive data
allModify Pimcore configuration to exclude $_COOKIE and $_SERVER from error logs.
🧯 If You Can't Patch
- Restrict access to the Pimcore backend to only trusted IP addresses and users.
- Regularly monitor and audit access to the http_error_log file for suspicious activity.
🔍 How to Verify
Check if Vulnerable:
Check your Pimcore version; if it's below 12.3.1 (for v12) or 11.5.14 (for v11), you are vulnerable.Check Version:
php bin/console pimcore:versionVerify Fix Applied:
After updating, verify the version is 12.3.1 or 11.5.14 and check that the http_error_log no longer contains $_COOKIE or $_SERVER data.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to the http_error_log file
- Suspicious reads of the log file from non-admin users
Network Indicators:
- Unusual traffic patterns to the Pimcore backend interface
SIEM Query:
source="pimcore" AND (event="file_access" AND file="*http_error.log*")🔗 References
- https://github.com/pimcore/pimcore/commit/002ec7d5f84973819236796e5b314703b58e8601
- https://github.com/pimcore/pimcore/pull/18918
- https://github.com/pimcore/pimcore/releases/tag/v11.5.14
- https://github.com/pimcore/pimcore/releases/tag/v12.3.1
- https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h
- https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h
