Read the docs
TI-2023-25777 Aliases CVE-2023-47636GHSA-c8hj-w239-5gvf

Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle

Priority MEDIUM 63CWE-209Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-209.

Summary

The Pimcore Admin Classic Bundle provides a Backend UI for Pimcore. Full Path Disclosure (FPD) vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the load_file() (within a SQL Injection) query to view the page source, require the attacker to have the full path to the file they wish to view. In the case of pimcore, the fopen() function here doesn't have an error handle when the file doesn't exist on the server so the server response raises the full path "fopen(/var/www/html/var/tmp/export-{ uniqe id}.csv)". This issue has been patched in commit `10d178ef771` which has been included in release version 1.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00654 51st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed admin-ui-classic-bundle (pimcore): 1.2.1pimcore/admin-ui-classic-bundle (Packagist): 1.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pimcoreadmin-ui-classic-bundlebefore 1.2.11.2.1Patch availableCNA
—pimcore/admin-ui-classic-bundle (Packagist)before 1.2.11.2.1Patch availableGHSA-c8hj-w239-5gvf
  • admin-ui-classic-bundle Vendorpimcore Affected before 1.2.1 Fixed in 1.2.1 Patch available CNA
  • pimcore/admin-ui-classic-bundle (Packagist) Vendor— Affected before 1.2.1 Fixed in 1.2.1 Patch available GHSA-c8hj-w239-5gvf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pimcore:admin_classic_bundle:*:*:*:*:*:pimcore:*:*before 1.2.1Vulnerablepimcore
  • cpe:2.3:a:pimcore:admin_classic_bundle:*:*:*:*:*:pimcore:*:* Versions before 1.2.1 Vulnerable ·pimcore

Remediation

  • Fix · CNA admin-ui-classic-bundle (pimcore) Fixed in 1.2.1
  • Fix · GHSA-c8hj-w239-5gvf pimcore/admin-ui-classic-bundle (Packagist) Fixed in 1.2.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-47636
  2. 2026-10-03 Alias added: GHSA-c8hj-w239-5gvf
  3. 2026-10-14 EPSS moved to the 50th–90th percentile

References

Exploit 1

Patch 1

Advisory 2

Other 2

  • TI-2024-15667 Pimcore Admin Classic Bundle host header injection in the password reset CVSS 3.1HIGH 8.8
  • TI-2024-16853 Pimcore Host Header Injection in user invitation link CVSS 3.1CRITICAL 9.3
  • TI-2024-15665 Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip CVSS 3.1HIGH 8.8
  • TI-2025-18658 Pimcore Admin Classic Bundle allows user enumeration CVSS 4.0MEDIUM 6.9
  • TI-2023-05380 Unverified Password Change in pimcore/admin-ui-classic-bundle CVSS 3.1HIGH 7.2
  • TI-2024-27461 Pimcore vulnerable to disclosure of system and database information behind /admin firewall CVSS 3.1MEDIUM 6.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences