CVE-2026-109392

Executive Summary

CVE-2026-109392 is a stored cross-site scripting (XSS) vulnerability in Pimcore through version 2026.3.1. Authenticated backend users holding data object edit permissions can persist malicious payloads via unescaped URLs in ExternalImage fields; these payloads execute JavaScript in the admin origin when other users open version preview or diff views. The flaw requires low privileges and user interaction, carries a CVSS base score of 5.4, and remains unpatched according to all tracked sources, leaving administrative sessions at risk of script execution within the trusted backend context.

Technical Analysis

The vulnerability resides in Pimcore's handling of the ExternalImage field type. When a backend user stores a URL value in such a field, the application does not adequately escape the value before rendering it in version preview and diff views. Because the stored value is treated as an attribute within the admin interface, an attacker can craft an attribute-breaking payload that terminates the surrounding HTML attribute context and injects executable script content.

This is a classic stored (persistent) XSS condition (CWE-79). The defining characteristics derive directly from the NVD description:

• Storage vector: Data object fields of type ExternalImage accept user-supplied URLs that are persisted without proper output encoding.
• Trigger surface: Version preview and diff views — admin-side rendering paths that reconstruct historical field values for comparison.
• Sink behavior: The unescaped URL is emitted into the admin origin's HTML. An attribute-breaking payload (e.g., content that closes the attribute and introduces an event handler or script element) causes the browser to execute attacker-controlled JavaScript.
• Privilege boundary: The attacker must already be an authenticated backend user with data object edit permission. This is not an anonymous or unauthenticated attack.

The skill set required is low. No memory corruption, race condition, or complex chaining is involved; the attack is a direct consequence of missing output encoding. The CVSS vector confirms network accessibility (AV:N), low attack complexity (AC:L), low privileges required (PR:L), and required user interaction (UI:R). The scope change (S:C) reflects that the injected script executes in the security context of the admin origin, potentially affecting resources beyond the immediate vulnerable component. Confidentiality and integrity impacts are low (C:L/I:L), and availability impact is none (A:N).

Because the payload executes in the admin origin, any other administrative user who views the affected version preview or diff becomes a victim. Session cookies, CSRF tokens, and other secrets accessible to JavaScript in that origin may be exfiltrated or manipulated. The vulnerability affects the integrity of the rendered interface and can be used to perform privileged actions on behalf of the victim via the admin UI.

At the time of writing, no public proof-of-concept, exploit code, or Nuclei template has been observed. All analysis is therefore based on the vulnerability class and the explicit description provided. No specific function names, file paths, or API endpoints are available from the source data, and none are invented here.

Exploitation Scenarios

The following attack chain is inferred from the stored XSS vulnerability class and the details supplied in the NVD description. No public PoC is available.

1. Reconnaissance / target identification An attacker identifies a Pimcore instance running version 2026.3.1 or earlier with an accessible backend. Reconnaissance focuses on confirming the version and locating data objects that contain ExternalImage fields. This requires at minimum a valid backend account with data object edit permissions — the attacker either has legitimate low-privileged access, has compromised such an account, or is a malicious insider.

2. Triggering the flaw Using the edit interface, the attacker stores a crafted URL in an ExternalImage field. The payload is designed to break out of the HTML attribute context in which the value will later be rendered. Because the value is not escaped, it is persisted in its raw form. The attacker saves the data object, completing the injection.

3. Payload execution The stored payload remains dormant until another backend user opens a version preview or a diff view containing the affected field. At that moment, the application renders the unescaped URL into the admin origin's HTML. The attribute-breaking payload causes the browser to parse and execute the embedded JavaScript. Execution occurs in the context of the admin origin — the same origin that hosts sensitive administrative functionality.

4. Post-exploitation impact Once script execution is achieved in the admin origin, the attacker can perform actions available to the victim's session: reading and exfiltrating data visible to that user, issuing authenticated requests to the backend (subject to any CSRF protections that the script can bypass by running in-origin), manipulating the DOM to phish credentials or trick the victim into additional actions, and maintaining persistence by re-injecting payloads. The scope change indicated by the CVSS vector (S:C) underscores that the vulnerable component (the field rendering) can affect the broader admin application context. The attack does not directly achieve remote code execution or full server compromise, but it significantly elevates the attacker's effective privilege within the application.

Impact Assessment

The primary impact is to the confidentiality and integrity of the Pimcore administrative backend. Because payloads execute in the admin origin, any administrative user who views the poisoned version preview or diff is a potential victim. This can lead to:

• Session and credential theft: Cookies, tokens, and secrets accessible to JavaScript in the admin origin can be exfiltrated.
• Privileged action execution: The script can issue authenticated requests as the victim, potentially performing actions the attacker's own account cannot.
• Data exposure: Sensitive content managed in the CMS (product data, customer information, internal documents) may be read and transferred to attacker infrastructure.
• Persistence: A stored payload can be re-triggered repeatedly, making it difficult to eradicate without locating every injected field.

The CVSS base score of 5.4 reflects a moderate severity: network-accessible, low complexity, low privileges required, but requiring user interaction and with limited direct confidentiality and integrity impact. However, in environments where Pimcore governs high-value content or where multiple administrators share the backend, the practical blast radius can be substantial. There is no availability impact. The vulnerability is not listed in CISA KEV, and no EPSS score has been assigned by FIRST.org at this time.

Affected systems are any Pimcore deployments running version 2026.3.1 or earlier. No packages are formally listed in OSV, and the affected version range is described only as "through 2026.3.1." Organizations should treat all versions up to and including 2026.3.1 as vulnerable.

Detection Guidance

Sigma Rule

title: Pimcore ExternalImage Stored XSS Payload Storage
id: 8f3a1c92-7b4e-4d2a-9c1f-6e5d8a3b2c71
status: experimental
description: Detects a backend user storing an ExternalImage field value containing attribute-breaking HTML/script characters in Pimcore, indicative of CVE-2026-109392 stored XSS.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109392
author: Valters IT Threat Intelligence
date: 2026/06/01
tags:
  - attack.t1059.007
  - attack.persistence
logsource:
  product: pimcore
  service: audit
detection:
  selection_action:
    action|contains:
      - 'update'
      - 'create'
      - 'save'
  selection_fields:
    field_type: 'ExternalImage'
    value|contains:
      - '<script'
      - 'onerror='
      - 'onload='
      - '"><'
      - 'javascript:'
      - 'onmouseover='
  condition: selection_action and selection_fields
falsepositives:
  - Legitimate URLs containing encoded angle brackets in query strings
level: high

YARA Rule

rule CVE_2026_109392_Pimcore_ExternalImage_Stored_XSS
{
    meta:
        description = "Detects attribute-breaking XSS payloads in Pimcore ExternalImage field storage or logs"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109392"
        date = "2026-06-01"
        severity = "high"

    strings:
        $xss1 = "<script" ascii nocase wide
        $xss2 = "onerror=" ascii nocase wide
        $xss3 = "onload=" ascii nocase wide
        $xss4 = "onmouseover=" ascii nocase wide
        $attr1 = "\"><img" ascii nocase wide
        $attr2 = "\"><svg" ascii nocase wide
        $js1 = "javascript:" ascii nocase wide
        $ctx1 = "ExternalImage" ascii nocase wide

    condition:
        2 of ($xss*) or 2 of ($attr*) or any of ($js*) and $ctx1
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109392 Pimcore ExternalImage Stored XSS Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.header; content:"Cookie"; http.request_body; content:"ExternalImage"; nocase; http.request_body; content:"<script"; nocase; http.request_body; content:"onerror="; nocase; classtype:web-application-attack; sid:202609392; rev:1; reference:cve,2026-109392;)

Elastic Detection

sequence by user.id with maxspan=5s
  [http where http.request.method == "POST" and
   url.path : "*pimcore*" and
   stringContains(http.request.body, "ExternalImage")]
  [http where http.request.method == "POST" and
   (stringContains(http.request.body, "<script") or
    stringContains(http.request.body, "onerror=") or
    stringContains(http.request.body, "onload=") or
    stringContains(http.request.body, "onmouseover="))]

Splunk SPL Query

index=web OR index=pimcore
| search (method=POST OR http_method=POST)
| search uri_path="*pimcore*"
| search (request_body="*ExternalImage*" AND (request_body="*<script*" OR request_body="*onerror=*" OR request_body="*onload=*" OR request_body="*onmouseover=*" OR request_body="*javascript:*"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri_path
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,pimcore,xss,">
  <rule id="109392" level="12">
    <if_sid>31100</if_sid>
    <match>ExternalImage</match>
    <regex type="pcre2">(?i)(<script|onerror=|onload=|onmouseover=|javascript:)</regex>
    <description>CVE-2026-109392: Possible Pimcore ExternalImage stored XSS payload injection in HTTP request</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>cve_2026_109392,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence, vendor fix, or workaround is available from any tracked source. No packages are listed in OSV, and affected versions are described only as "through 2026.3.1."

1. Immediate mitigations

• Restrict data object edit permissions to the smallest possible set of trusted users. The attack requires edit permission; reducing the number of accounts that hold it reduces exposure.
• Enforce strict Content Security Policy (CSP) headers on the Pimcore admin interface to limit inline script execution and restrict script sources. A robust CSP is the single most effective compensating control against stored XSS in the admin origin.
• Deploy the detection rules above to alert on ExternalImage field values containing attribute-breaking characters or script keywords.
• Monitor and review version preview and diff view access for unexpected activity by low-privileged accounts.
• If feasible, apply input validation at the web application firewall (WAF) layer to reject ExternalImage values containing <script, event-handler attributes, or javascript: schemes.

2. Patch / upgrade steps

• No patch is currently available. Monitor the Pimcore vendor advisory channels, NVD, and OSV for a fixed release. Once a patch is published, upgrade all instances running version 2026.3.1 or earlier to the patched version immediately.
• Verify the integrity of ExternalImage field data across all data objects and remove any stored values containing HTML or JavaScript constructs.

3. Long-term hardening

• Adopt a secure development practice of context-aware output encoding for all user-supplied values rendered into HTML, especially in administrative interfaces and version history views.
• Implement a defense-in-depth approach: CSP, output encoding, input validation, and regular security review of field types that render user-controlled URLs.
• Restrict the Pimcore admin interface to trusted networks or VPN access where operationally possible.
• Conduct periodic access reviews for backend users with data object edit permissions.
• Track CVE-2026-109392 for future patch availability and reassess patch confidence as new information emerges.

References

• NVD — CVE-2026-109392: https://nvd.nist.gov/vuln/detail/CVE-2026-109392
• Pimcore official security advisories: https://pimcore.com/en/security
• OWASP — Stored Cross Site Scripting (XSS): https://owasp.org/www-community/attacks/xss/
• MITRE ATT&CK — T1059.007 Command and Scripting Interpreter: JavaScript: https://attack.mitre.org/techniques/T1059/007/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-109392 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence have been observed for CVE-2026-109392. The vulnerability is not listed in CISA KEV, no public PoC exists, and no EPSS score has been assigned by FIRST.org at the time of writing.