Pimcore Hotspotimage Component Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- pimcore (packagist)
- Affected versions
- >= 2026.1.0, <= 2026.1.5 or <= 12.3.9
- Patched version
- Not yet available
An early warning has been issued for a vulnerability in the Pimcore Hotspotimage component that may lead to PHP Object Injection and potential remote code execution. Affected components include Pimcore's Hotspotimage, ImageGallery, Block, and Video.
What happened
The Pimcore Hotspotimage component reportedly deserializes data without a class allowlist, which may lead to PHP Object Injection and potential remote code execution. This vulnerability affects Pimcore versions >= 2026.1.0 and <= 2026.1.5 or <= 12.3.9. The affected components are Pimcore's Hotspotimage, ImageGallery, Block, and Video. This issue is under investigation and has not been exploited in the wild.
Users of Pimcore should assess their exposure by checking if they are running any of the affected versions. It is recommended to upgrade to a version of Pimcore that includes a fix for the deserialization vulnerability and to review and sanitize all serialized data inputs.
What to do about it
- Upgrade to a version of Pimcore that includes a fix for the deserialization vulnerability.
- Review and sanitize all serialized data inputs to prevent potential exploitation.
- Monitor the primary sources for updates on the vulnerability and any available patches.
- Consult the primary sources for the most current information on affected versions and recommended actions.
How 0Day would have caught this
pimcore is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using Pimcore versions >= 2026.1.0 and <= 2026.1.5 or <= 12.3.9.
What should I do right now?
Upgrade to a version of Pimcore that includes a fix for the deserialization vulnerability and review and sanitize all serialized data inputs.
Has an official fix been published?
No official fix has been published yet. Monitor the primary sources for updates.