Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

published 2022-09-21 4 y ago modified 2026-06-17 4 mo ago also GHSA-wqr6-57qm-hhr5 , EUVD-2022-6966

cvss: 6.8; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.8%; EPSS 0.8% chance of exploitation in 30 days, percentile 57%
public exploits: 0; none known

If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is able to view. Modify any information that the user is able to modify. Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.

Patch / fix

fixed in 2 links 1

packagist pimcore/pimcore 10.5.7
pimcore pimcore/pimcore 10.5.7

github.com/pimcore/pimcore@1e916e7 commit

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 17 mo ago (2025-05-28)

Exploit prediction

0.82% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

huntr.dev https://huntr.dev/bounties/0ea45cf9-b256-454c-9031-2435294c0902 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.0	6.8	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
NVD	3.1	4.8	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
GitHub	3.0	6.8	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
packagist	pimcore/pimcore	<10.5.7	10.5.7

Affected products

pimcore pimcore/pimcore

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

github.com /pimcore/pimcore/commit/1e916e7d668c9e47b217e20cc0ea4812f466201b
web, patch, third-party-advisory
huntr.dev /bounties/0ea45cf9-b256-454c-9031-2435294c0902
web, exploit, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2022-3255
advisory
github.com /pimcore/pimcore
package

Sources

CVE List CVE-2022-3255
GitHub Advisory GHSA-wqr6-57qm-hhr5
NVD CVE-2022-3255

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary