CVEs / CVE-2019-10867
CVE-2019-10867: n/a n/a vulnerability
- high 8.8 CVSS 3.0 (NVD)
- EPSS 71% chance of exploitation in the next 30 days, higher than 99% of CVEs (14 Nov 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2019-10867
Description
An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| n/a n/a | n/a | — |
| Product | Affected | Fixed in |
|---|---|---|
| pimcore/pimcore (Packagist) | before 5.7.1 | 5.7.1 |
Package versions from GHSA-7hqr-j26m-gmwp.
Exploitation
Not in the CISA Known Exploited Vulnerabilities catalog as of 13 Nov 2026.
Severity
| CVSS 3.0 | 8.8 highCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HScored by NVD |
|---|---|
| Weakness | CWE-502 |
References
- CVE-2019-10867 on NVD
- CVE-2019-10867 on OSV
- http://packetstormsecurity.com/files/152667/Pimcore-Unserialize-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- http://www.rapid7.com/db/modules/exploit/multi/http/pimcore_unserialize_rce Third Party Advisory
- https://blog.certimetergroup.com/it/articolo/security/polyglot_phar_deserialization_to_rce
- https://github.com/pimcore/pimcore/commit/38a29e2f4f5f060a73974626952501cee05fda73 Patch, Third Party Advisory
- https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-173998 Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/46783/ Exploit, Third Party Advisory, VDB Entry
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.