Medium severity5.4NVD Advisory· Published Oct 12, 2026· Updated Oct 12, 2026
CVE-2026-109392
CVE-2026-109392
Description
Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields. Attackers with data object edit permission can store attribute-breaking payloads that execute JavaScript in the admin origin when other users open version preview or diff views.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
4- github.com/pimcore/admin-ui-classic-bundle/blob/2.3/templates/admin/data_object/data_object/preview_version.html.twignvd
- github.com/pimcore/pimcore/blob/v2026.3.1/models/DataObject/ClassDefinition/Data/ExternalImage.phpnvd
- hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/rJCbgCKjMenvd
- www.vulncheck.com/advisories/pimcore-through-2026.3.1-stored-xss-via-externalimage-field-version-previewnvd
News mentions
0No linked articles in our index yet.