Vulnerabilities

TI-2026-70677 CVE-2026-108697 · GHSA-2mh2-mmxq-355q

Missing authorization in CoreShop lets backend users list restricted resources

MEDIUM 57

CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restricted resources because ResourceController listAction skips the isGrantedOr403() c…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00251 Published 2026-10-11 No fix listed CWE-862

TI-2026-29858 CVE-2026-41249 · GHSA-q58j-g3f4-h26h

CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration

HIGH 75

CoreShop is a Pimcore enhanced eCommerce solution.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00549 Published 2026-06-04 No fix listed CWE-94

TI-2026-19301 CVE-2026-23959 · GHSA-fqcv-8859-86x2

CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier

MEDIUM 64

CoreShop is a Pimcore enhanced eCommerce solution.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00423 Published 2026-01-22 Fixed in 4.1.9 CWE-564

TI-2026-17852 CVE-2026-22242 · GHSA-ch7p-mpv4-4vg4

CoreShop Vulnerable to SQL Injection via Admin Reports

MEDIUM 56

CoreShop is a Pimcore enhanced eCommerce solution.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00425 Published 2026-01-08 Fixed in 4.1.8 CWE-564

Vulnerabilities

Filters

Missing authorization in CoreShop lets backend users list restricted resources

CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration

CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier

CoreShop Vulnerable to SQL Injection via Admin Reports