Improper Neutralization of Special Elements Used in a Template Engine

Overview pimcore/pimcore is a content & product management framework CMS/PIM/E-Commerce. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine in the checkMethodAllowed and checkPropertyAllowed implementations of the custom Twig...

GHSA-7P36-FQ2R-4H7R Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed

Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed and checkPropertyAllowed implementations in the custom Twig SecurityPolicy. Attackers can...