Every CVE Search/ Get API key

CVE-2024-11954

Pimcore Search Document cross site scripting

5.1 MediumPublic exploitFix available

A vulnerability classified as problematic was found in Pimcore 11.4.2. Affected by this vulnerability is an unknown functionality of the component Search Document. The manipulation leads to basic cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

1.12%Up 1.1 points since Jan 29, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.1

Pimcore Search Document cross site scripting

A vulnerability classified as problematic was found in Pimcore 11.4.2. Affected by this vulnerability is an unknown functionality of the component Search Document. The manipulation leads to basic cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Record
CVE-2024-11954
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
2.4 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CVSS 3.0
2.4 LowCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CVSS 2.0
3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N
Weakness
CWE-80, CWE-74
Updated
2026-11-02
EUVDEUVD-2024-34410 5.1

A vulnerability classified as problematic was found in Pimcore 11.4.2. Affected by this vulnerability is an unknown functionality of the component Search Document. The manipulation leads to basic cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Record
EUVD-2024-34410
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-xr3m-6gq6-22cg 8.1

Pimcore Authenticated Stored Cross-Site Scripting (XSS) Via Search Document

Summary

A Stored Cross-Site Scripting (XSS) vulnerability in PIMCORE allows remote attackers to inject arbitrary web script or HTML via the PDF upload functionality. This can result in the execution of malicious scripts in the context of the user's browser when the PDF is viewed, leading to potential session hijacking, defacement of web pages, or unauthorized access to sensitive information.

Details

The vulnerability is present in the PDF upload functionality of the PIM Core Upload module. When a user uploads a PDF file, the application fails to properly sanitize the content, allowing embedded scripts to be executed when the PDF is viewed. The affected code is located in the file handling and rendering logic of the PDF upload feature.

PoC

  1. Log in as Administrator

  2. Hover to Assets

  3. Right click and click "Add Asset(s) > upload files

  4. Upload malicious pdf

  5. Click on search and select document

  6. copy the path and open to a new tab

https://demo.pimcore.fun/admin/Sample C

  1. XSS PDF can be access without authentication.

Image showing no cookies indicator that there are no session currently in

Impact

This is a Stored Cross-Site Scripting (XSS) vulnerability. It impacts any user who views the malicious PDF, potentially leading to session hijacking, defacement of web pages, or unauthorized access to sensitive information. The severity is high due to the potential for significant impact on confidentiality and integrity.

Record
GHSA-xr3m-6gq6-22cg
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 5.1

A vulnerability classified as problematic was found in Pimcore 11.4.2. Affected by this vulnerability is an unknown functionality of the component Search Document. The manipulation leads to basic cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Record
CVE-2024-11954
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
2.4 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
3.3 LowAV:N/AC:L/Au:M/C:N/I:P/A:N
Weakness
CWE-74, CWE-80
Updated
2026-11-02
OSV 5.1

Pimcore Search Document cross site scripting

A vulnerability classified as problematic was found in Pimcore 11.4.2. Affected by this vulnerability is an unknown functionality of the component Search Document. The manipulation leads to basic cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Record
CVE-2024-11954
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-74, CWE-80
Updated
2026-11-02
OSVGHSA-xr3m-6gq6-22cg 8.1

Pimcore Authenticated Stored Cross-Site Scripting (XSS) Via Search Document

Summary

A Stored Cross-Site Scripting (XSS) vulnerability in PIMCORE allows remote attackers to inject arbitrary web script or HTML via the PDF upload functionality. This can result in the execution of malicious scripts in the context of the user's browser when the PDF is viewed, leading to potential session hijacking, defacement of web pages, or unauthorized access to sensitive information.

Details

The vulnerability is present in the PDF upload functionality of the PIM Core Upload module. When a user uploads a PDF file, the application fails to properly sanitize the content, allowing embedded scripts to be executed when the PDF is viewed. The affected code is located in the file handling and rendering logic of the PDF upload feature.

PoC

  1. Log in as Administrator

  2. Hover to Assets

  3. Right click and click "Add Asset(s) > upload files

  4. Upload malicious pdf

  5. Click on search and select document

  6. copy the path and open to a new tab

https://demo.pimcore.fun/admin/Sample C

  1. XSS PDF can be access without authentication.

Image showing no cookies indicator that there are no session currently in

Impact

This is a Stored Cross-Site Scripting (XSS) vulnerability. It impacts any user who views the malicious PDF, potentially leading to session hijacking, defacement of web pages, or unauthorized access to sensitive information. The severity is high due to the potential for significant impact on confidentiality and integrity.

Record
GHSA-xr3m-6gq6-22cg
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pimcore/pimcore
Packagist
 11.4.2 up to 11.5.3
11.5.3
pimcore/pimcore
Packagist
 11.4.2 up to 11.5.3, plus listed versions
v11.4.2v11.4.3v11.4.4v11.5.0v11.5.0-RC1v11.5.0-RC2v11.5.1v11.5.2
11.5.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBPimcore 11.4.2 - Stored cross site scripting2025-04-14

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-11954 is a medium vulnerability (CVSS 5.1) in Pimcore, published January 28, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.12%, the 66th percentile. Fixed in pimcore/pimcore 11.5.3.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open