High severity8.0NVD Advisory· Published Aug 18, 2021· Updated Jun 17, 2026

CVE-2021-37702

Description

Pimcore is an open source data & experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. The problem is patched in 10.1.1. Aside from upgrading, one may apply the patch manually as a workaround.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
pimcore/pimcorePackagist	< 10.1.1	10.1.1

Affected products

Pimcore/Pimcore2 versions
cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*range: <10.1.1
- (no CPE)range: < 10.1.1
ghsa-coords
pkg:composer/pimcore/pimcore
Range: < 10.1.1

Patches

Vulnerability mechanics

References

github.com/pimcore/pimcore/pull/9992nvdPatchThird Party AdvisoryWEB
github.com/pimcore/pimcore/security/advisories/GHSA-pp2h-95hm-hv9rnvdPatchThird Party AdvisoryWEB
github.com/advisories/GHSA-pp2h-95hm-hv9rghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2021-37702ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.520
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000