CVE-2026-5362: Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering
An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution when the published page is rendered.
This issue affects pimcore: v12.3.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5362?
CVE-2026-5362 is classified as a high-severity vulnerability due to its potential for stored XSS attacks.
How do I fix CVE-2026-5362?
To fix CVE-2026-5362, upgrade to Pimcore Platform version 12.3.4 or later, where the vulnerability has been patched.
Who is affected by CVE-2026-5362?
CVE-2026-5362 affects users of Pimcore Platform version 12.3.3 that have permissions to edit document content.
What kind of attack can be executed using CVE-2026-5362?
CVE-2026-5362 allows an authenticated attacker to execute stored XSS attacks through crafted HTML/JavaScript embedded in document content.
How does CVE-2026-5362 impact document rendering?
CVE-2026-5362 impacts document rendering by executing malicious scripts when the published page containing the embedded content is viewed.