CVE-2022-39365: RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in Pimcore/Mail & ClassDefinition\Layout\Text is vulnerable to server-side template injection, which could lead to remote code execution. Version 10.5.9 contains a patch for this issue. As a workaround, one may apply the patch manually.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-39365?
CVE-2022-39365 is considered a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2022-39365?
To patch CVE-2022-39365, upgrade your Pimcore installation to version 10.5.9 or later.
What type of vulnerability is CVE-2022-39365?
CVE-2022-39365 is a server-side template injection vulnerability.
What can an attacker do with CVE-2022-39365?
An attacker exploiting CVE-2022-39365 could potentially execute arbitrary code on the server.
Which versions of Pimcore are affected by CVE-2022-39365?
Pimcore versions prior to 10.5.9 are affected by CVE-2022-39365.