Pimcore vulnerable to disclosure of system and database information behind /admin firewall
Priority MEDIUM 62CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system. This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00483 41st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed admin-ui-classic-bundle (pimcore): 1.5.2pimcore/admin-ui-classic-bundle (Packagist): 1.5.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pimcore | admin-ui-classic-bundle | before 1.5.2 | 1.5.2 | Patch available | CNA |
| — | pimcore/admin-ui-classic-bundle (Packagist) | before 1.5.2 | 1.5.2 | Patch available | GHSA-fx6j-9pp6-ph36 |
- admin-ui-classic-bundle Vendorpimcore Affected before 1.5.2 Fixed in 1.5.2 Patch available CNA
- pimcore/admin-ui-classic-bundle (Packagist) Vendor— Affected before 1.5.2 Fixed in 1.5.2 Patch available GHSA-fx6j-9pp6-ph36
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pimcore:admin_classic_bundle:*:*:*:*:*:pimcore:*:* | before 1.3.10; 1.4.0 to before 1.4.6; 1.5.0 to before 1.5.2 | Vulnerable | pimcore |
- cpe:2.3:a:pimcore:admin_classic_bundle:*:*:*:*:*:pimcore:*:* Versions before 1.3.10; 1.4.0 to before 1.4.6; 1.5.0 to before 1.5.2 Vulnerable ·pimcore
Remediation
- Fix · CNA admin-ui-classic-bundle (pimcore) Fixed in 1.5.2
- Fix · GHSA-fx6j-9pp6-ph36 pimcore/admin-ui-classic-bundle (Packagist) Fixed in 1.5.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-41109
- 2026-10-03 Alias added: GHSA-fx6j-9pp6-ph36
References
Patch 1
More pimcore Admin Classic Bundle vulnerabilities
- TI-2024-15667 Pimcore Admin Classic Bundle host header injection in the password reset CVSS 3.1HIGH 8.8
- TI-2024-16853 Pimcore Host Header Injection in user invitation link CVSS 3.1CRITICAL 9.3
- TI-2024-15665 Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip CVSS 3.1HIGH 8.8
- TI-2025-18658 Pimcore Admin Classic Bundle allows user enumeration CVSS 4.0MEDIUM 6.9
- TI-2023-05380 Unverified Password Change in pimcore/admin-ui-classic-bundle CVSS 3.1HIGH 7.2
- TI-2023-25777 Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle CVSS 3.1MEDIUM 5.3
Sources
- CVE-2024-41109 · CVE Program
- CVE-2024-41109 · NVD
- FIRST EPSS
- GHSA-fx6j-9pp6-ph36 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences