TI-2021-16552 Aliases CVE-2021-39166 GHSA-w6j8-jc36-x5q9

Improper Neutralization of Text-Values in Object Version Preview

LOW 36CWE-79Published 2021-09-01 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources. This issue is patched in Pimcore version 10.1.2.

Why it matters now

EPSS 0.00781 56th percentileScored 2026-11-07

Fix Fixed pimcore (pimcore): 10.1.2pimcore/pimcore (Packagist): 10.1.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pimcore	pimcore	before 10.1.2	10.1.2	Patch available	CNA
—	pimcore/pimcore (Packagist)	before 10.1.2	10.1.2	Patch available	GHSA-w6j8-jc36-x5q9

pimcore Vendorpimcore Affected before 10.1.2 Fixed in 10.1.2 Patch available CNA
pimcore/pimcore (Packagist) Vendor— Affected before 10.1.2 Fixed in 10.1.2 Patch available GHSA-w6j8-jc36-x5q9

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:pimcore:pimcore::::::::	before 10.1.2	Vulnerable	pimcore

cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:* Versions before 10.1.2 Vulnerable ·pimcore

Remediation

Fix · CNA pimcore (pimcore) Fixed in 10.1.2
Fix · GHSA-w6j8-jc36-x5q9 pimcore/pimcore (Packagist) Fixed in 10.1.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-39166
2026-10-03 Alias added: GHSA-w6j8-jc36-x5q9

References

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2021-39166

Other 1

https://github.com/pimcore/pimcore

TI-2026-18925 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848 CVSS 3.1HIGH 8.8
TI-2026-18926 Pimcore ENV Variables and Cookie Informations are exposed in http_error_log CVSS 3.1HIGH 8.6
TI-2023-01489 SQL Injection in pimcore/pimcore CVSS 3.1HIGH 8.8
TI-2019-08091 An issue was discovered in Pimcore before 5.7.1. CVSS 3.0HIGH 8.8
TI-2023-25778 SQL Injection in Admin Grid Filter API in Pimcore CVSS 3.1HIGH 8.8
TI-2023-10682 An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code. CVSS 3.1HIGH 8.8

See all 126 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences