CVE-2023-2984
Path Traversal: '\..\filename' in pimcore/pimcore
Path Traversal: '..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Path Traversal: '\..\filename' in pimcore/pimcore
Path Traversal: '..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.
- Record
CVE-2023-2984- CVSS 3.0
- 6.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-29
- Updated
- 2026-11-02
EUVDEUVD-2023-1679
Path Traversal: '..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.
- Record
EUVD-2023-1679- CVSS 3.0
- 6.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-46g3-f9r8-xj4v
Pimcore vulnerable to Pre-Auth Path Traversal in pimcore_log parameter
Impact
A path traversal vulnerability exists in the CMS, which allows an attacker to overwrite or modify sensitive files by manipulating the pimcore_log parameter.This can lead to potential denial of service---key file overwrite.
The impact of this vulnerability allows attackers to:
-
Overwrite or modify sensitive files, potentially leading to unauthorized access, privilege escalation, or disclosure of confidential information.
-
Tamper with system settings by modifying key files, such as the hosts file in Windows or configuration files for other services.
-
Cause a denial of service (DoS) if critical system files are overwritten or deleted.
The consequences of exploiting this vulnerability can be detrimental to the confidentiality, integrity, and availability of the affected system. It's crucial to address this vulnerability to protect sensitive data and ensure the proper functioning of the system.
Patches
Update to version 10.5.22 or apply this patch manually https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed.patch
Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed.patch manually.
References
https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191/
- Record
GHSA-46g3-f9r8-xj4v- CVSS 3.0
- 6.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-29
- Updated
- 2026-11-02
NVD
Path Traversal: '..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.
- Record
CVE-2023-2984- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 6.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-29
- Updated
- 2026-11-02
OSV
Path Traversal: '\..\filename' in pimcore/pimcore
Path Traversal: '..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.
- Record
CVE-2023-2984- CVSS 3.0
- 6.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-29
- Updated
- 2026-11-02
OSVGHSA-46g3-f9r8-xj4v
Pimcore vulnerable to Pre-Auth Path Traversal in pimcore_log parameter
Impact
A path traversal vulnerability exists in the CMS, which allows an attacker to overwrite or modify sensitive files by manipulating the pimcore_log parameter.This can lead to potential denial of service---key file overwrite.
The impact of this vulnerability allows attackers to:
-
Overwrite or modify sensitive files, potentially leading to unauthorized access, privilege escalation, or disclosure of confidential information.
-
Tamper with system settings by modifying key files, such as the hosts file in Windows or configuration files for other services.
-
Cause a denial of service (DoS) if critical system files are overwritten or deleted.
The consequences of exploiting this vulnerability can be detrimental to the confidentiality, integrity, and availability of the affected system. It's crucial to address this vulnerability to protect sensitive data and ensure the proper functioning of the system.
Patches
Update to version 10.5.22 or apply this patch manually https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed.patch
Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed.patch manually.
References
https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191/
- Record
GHSA-46g3-f9r8-xj4v- CVSS 3.0
- 6.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-29
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pimcore/pimcorePackagist |
before 10.5.22 | 10.5.22 |
pimcore/pimcorePackagist |
before 10.5.22, plus listed versions 10.0.82.2.02.2.12.2.22.3.0 Show 45 moreShow less3.0.03.0.13.0.23.0.33.0.43.0.53.0.63.1.03.1.14.0.04.0.14.1.04.1.14.1.24.1.34.2.04.3.04.3.14.4.04.4.14.4.24.4.34.5.04.6.04.6.14.6.24.6.34.6.44.6.5v10.0.0v10.0.0-BETA1v10.0.0-BETA2v10.0.0-BETA3v10.0.0-BETA4v10.0.1v10.0.2v10.0.3v10.0.4v10.0.5v10.0.6v10.0.7v10.0.9v10.1.0v10.1.1v10.1.2 |
10.5.22 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-2984 is a medium vulnerability (CVSS 6.3) in Pimcore, published May 30, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.85%, the 58th percentile. Fixed in pimcore/pimcore 10.5.22.
References
huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191
github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed
nvd.nist.gov/vuln/detail/CVE-2023-2984
Left out here: 162 versions. The JSON record has them.