What is CVE-2026-23493?

CVE-2026-23493 is a high-severity vulnerability in Pimcore, classified under Insertion of Sensitive Information into Log File. CVSS score: 8.6/10. Published 2026-01-15.

How severe is CVE-2026-23493?

High severity. CVSS v3 base score is 8.6 out of 10.

Information disclosure in Pimcore

CVE-2026-23493

Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensitive information such as database passwords, cookie session data, and other details can be accessed or recovered through the Pimcore backend. This vulnerability is fixed in 12.3.1 and 11.5.14.

Published 2026-01-15 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L.

EPSS exploit prediction

EPSS: 0.004 (35.1th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 35th percentile — 35.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: +0.000

Affected products

Pimcore — versions >= 12.0.0-RC1, < 12.3.1, < 11.5.14

Weakness classification (CWE)

CWE-532 — Insertion of Sensitive Information into Log File

References

github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h (Vendor Advisory)
github.com/pimcore/pimcore/pull/18918 (Issue Tracking)
github.com/pimcore/pimcore/commit/002ec7d5f84973819236796e5b314703b58e8601 (Patch)
github.com/pimcore/pimcore/releases/tag/v11.5.14 (Release Notes)
github.com/pimcore/pimcore/releases/tag/v12.3.1 (Release Notes)

Frequently asked questions

What is CVE-2026-23493?: CVE-2026-23493 is a high-severity vulnerability in Pimcore, classified under Insertion of Sensitive Information into Log File. CVSS score: 8.6/10. Published 2026-01-15.
How severe is CVE-2026-23493?: High severity. CVSS v3 base score is 8.6 out of 10.