Medium severity · published Jan 15, 2026
CVE-2026-23493
Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
4.9
CVSS
0.4%
EPSS
No
On KEV
Description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensitive information such as database passwords, cookie session data, and other details can be accessed or recovered through the Pimcore backend. This vulnerability is fixed in 12.3.1 and 11.5.14.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
pimcore · pimcore
>= 12.0.0-RC1, < 12.3.1; < 11.5.14 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23493
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-23493
Patch
https://github.com/pimcore/pimcore/commit/002ec7d5f84973819236796e5b314703b58e8601
Issue Tracking
https://github.com/pimcore/pimcore/pull/18918
Release Notes
https://github.com/pimcore/pimcore/releases/tag/v11.5.14
Release Notes
https://github.com/pimcore/pimcore/releases/tag/v12.3.1
Vendor Advisory
https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h
More from pimcore
9.9
CVE-2026-55634
Pimcore: Remote Code Execution via DataObject Class-Definition Field Name
9.8
CVE-2022-39365
RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
9.8
CVE-2019-18985
Pimcore before 6.2.2 lacks brute force protection for the 2FA token
9.8
CVE-2019-18981
Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification
9.3
CVE-2026-55220
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column