8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23493

CVE-2026-23493: Pimcore ENV Variables and Cookie Informations are exposed in http_error_log

Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensitive information such as database passwords, cookie session data, and other details can be accessed or recovered through the Pimcore backend. This vulnerability is fixed in 12.3.1 and 11.5.14.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23493

CVE-2026-23493:

8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pimcore/pimcore	composer	>= 12.0.0-RC1, <= 12.3	12.3.1
pimcore/pimcore	composer	<= 11.5.13	11.5.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the logging of sensitive information during exception handling. The Pimcore\Bundle\SeoBundle\EventListener\ResponseExceptionListener::onKernelException method is triggered on an exception, which in turn calls logToHttpErrorLog. This logToHttpErrorLog function was logging the $_COOKIE and $_SERVER superglobals, which can contain sensitive data such as session IDs, database credentials, and other environment variables. The patch removes the lines that serialize and log this sensitive data. Furthermore, the Pimcore\Bundle\SeoBundle\Controller\MiscController::httpErrorLogDetailAction function was responsible for reading this logged data from the database and displaying it in the admin interface, which is how the sensitive information was exposed to authenticated backend users. The patch for this function removes the logic that processes and displays the sensitive fields. The combination of these functions creates the vulnerability: one logs the data, and the other displays it.

Vulnerable functions

Pimcore\Bundle\SeoBundle\EventListener\ResponseExceptionListener::logToHttpErrorLog

bundles/SeoBundle/src/EventListener/ResponseExceptionListener.php

This function is responsible for logging HTTP errors. Before the patch, it serialized and stored the content of `$_COOKIE` and `$_SERVER` superglobals, which could contain sensitive information like session data and environment variables, into the database.

Pimcore\Bundle\SeoBundle\EventListener\ResponseExceptionListener::onKernelException

bundles/SeoBundle/src/EventListener/ResponseExceptionListener.php

This function is an event listener that triggers on application exceptions. It calls the `logToHttpErrorLog` function, initiating the process that leads to the logging of sensitive information. A runtime profile during exploitation would show this function in the call stack.

Pimcore\Bundle\SeoBundle\Controller\MiscController::httpErrorLogDetailAction

bundles/SeoBundle/src/Controller/MiscController.php

This function is used to display the details of a logged HTTP error. Before the patch, it would retrieve the serialized sensitive data (cookies and server variables) from the database, unserialize it, and make it available for display in the Pimcore backend, thus exposing the sensitive information to backend users.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.