CVE-2026-109392: Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview
Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields. Attackers with data object edit permission can store attribute-breaking payloads that execute JavaScript in the admin origin when other users open version preview or diff views.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Pimcore backend user who has permission to edit data objects can store a malicious URL in an ExternalImage field.
When does the stored payload execute?
The payload executes in the Pimcore admin origin when another user opens a version preview or diff view containing the affected ExternalImage value.
Are unauthenticated users exposed?
The described injection requires an authenticated backend user with data object edit permission. The trigger is an administrator or other backend user viewing the affected version preview or diff.
What permissions should be reviewed while remediation is pending?
Review and restrict data object edit permissions, particularly for users who can modify ExternalImage fields. Avoid opening version preview or diff views for objects whose ExternalImage URLs are untrusted.