CVE-2026-11407: Pimcore CMS/DXP Sandbox Bypass RCE Flaw

CVE-2026-11407 Overview

CVE-2026-11407 is a Twig sandbox bypass vulnerability in Pimcore CMS/DXP version 12.3.8. The flaw resides in the custom Twig SecurityPolicy implementation, where the checkMethodAllowed() and checkPropertyAllowed() methods are empty. Authenticated administrative attackers can supply malicious Twig templates through the DataObject ClassDefinition Layout\Text component to invoke arbitrary methods and properties on PHP objects. Exploitation enables arbitrary file reads, arbitrary database queries, and potential remote code execution via PHP object gadget chains. The pimcore_* function wildcard further broadens the bypass to every Pimcore Twig function. The weakness is classified under [CWE-1336] (Improper Neutralization of Special Elements Used in a Template Engine).

Critical Impact
Authenticated administrators can escape the Twig sandbox to read arbitrary files, run database queries, and potentially execute arbitrary code on the underlying host.

Affected Products

Pimcore CMS/DXP version 12.3.8
Pimcore lib/Twig/Sandbox/SecurityPolicy.php custom security policy
Pimcore DataObject ClassDefinition Layout\Text Twig rendering component

Discovery Timeline

2026-06-17 - CVE-2026-11407 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-11407

Vulnerability Analysis

Pimcore ships a custom SecurityPolicy that implements Twig's SecurityPolicyInterface to enforce sandbox restrictions on user-supplied templates. In version 12.3.8, the checkMethodAllowed() and checkPropertyAllowed() methods contain no logic, so every method call and property access on PHP objects passes the policy check. An attacker with administrative access to the DataObject ClassDefinition editor can place Twig markup in the Layout\Text component. When the template is rendered, the sandbox accepts expressions that traverse from any reachable object into Pimcore's data access layer. The result is an authenticated bypass that exposes the full PHP object graph to template authors.

Root Cause

The root cause is missing enforcement inside the Pimcore-supplied SecurityPolicy class. The class was designed to disable Twig's default method and property checks, leaving template authors free to call any accessor on any returned object. Combined with the pimcore_* function wildcard in the function allowlist, this design allows reaching sensitive helpers such as getDao() and database connection objects from inside the sandbox.

Attack Vector

The attack vector is network-based and requires high privileges. An attacker authenticated as a Pimcore administrator submits a crafted Twig template through the DataObject ClassDefinition Layout\Text field. Rendering the template invokes arbitrary methods on objects such as Pimcore\Model\Dao\AbstractDao, Doctrine\DBAL\Connection, or PDO, enabling file reads, SQL execution, and gadget-chain-driven code execution.

php

 use Twig\Sandbox\SecurityNotAllowedFilterError;
 use Twig\Sandbox\SecurityNotAllowedFunctionError;
+use Twig\Sandbox\SecurityNotAllowedMethodError;
+use Twig\Sandbox\SecurityNotAllowedPropertyError;
 use Twig\Sandbox\SecurityNotAllowedTagError;
 use Twig\Sandbox\SecurityPolicyInterface;

 /**
- * Note: Reused to disable checks on object methods and properties.
- *
- * Represents a security policy which need to be enforced when sandbox mode is enabled.
+ * Represents a security policy which needs to be enforced when sandbox mode is enabled.
  *
  * @author Fabien Potencier <fabien@symfony.com>
  */
 final class SecurityPolicy implements SecurityPolicyInterface
 {
+    /**
+     * Classes whose instances must not be traversable from Twig templates.
+     * Method calls and property accesses on objects that are instances of any of these
+     * classes will throw, preventing templates from traversing into
+     * database or infrastructure layers (e.g. object.getDao().db.fetchOne(...)).
+     */
+    private const BLOCKED_CLASSES = [
+        \Pimcore\Model\Dao\AbstractDao::class,
+        \Doctrine\DBAL\Connection::class,
+        \PDO::class,
+        \PDOStatement::class,
+        \Symfony\Component\DependencyInjection\ContainerInterface::class,

Source: Pimcore SecurityPolicy patch commit

Detection Methods for CVE-2026-11407

Indicators of Compromise

Twig templates stored in DataObject ClassDefinition Layout\Text fields that reference getDao(), db, fetchOne, fetchAll, or query accessors.
Use of pimcore_* Twig functions in unexpected ClassDefinition layouts edited by administrative accounts.
Web server processes spawning child processes such as sh, bash, or php -r immediately after Pimcore admin template renders.
Unexpected outbound database connections or file reads from the Pimcore PHP-FPM worker pool.

Detection Strategies

Audit DataObject ClassDefinition exports for Twig expressions containing method chains on objects, especially calls to getDao() or container accessors.
Enable Twig render logging in non-production tiers and compare template ASTs against an allowlist of expected accessors.
Correlate Pimcore admin authentication events with subsequent ClassDefinition modifications and template render errors referencing SecurityNotAllowedMethodError.

Monitoring Recommendations

Forward Pimcore application logs, PHP error logs, and web server access logs to a central analytics platform for query-time inspection.
Alert on administrative API calls to ClassDefinition endpoints (/admin/class/save, /admin/class/import-class) outside change windows.
Monitor the Pimcore service account for unusual filesystem reads of /etc/, application secrets, or environment files.

How to Mitigate CVE-2026-11407

Immediate Actions Required

Upgrade Pimcore CMS/DXP to a release that includes the fix from pull request #19193 and commit fffa7f6396329e88610db70a8652529bbc734892.
Restrict administrative access to the Pimcore backend to a minimal set of trusted operators and enforce multi-factor authentication.
Review every existing DataObject ClassDefinition Layout\Text field for unauthorized Twig content and remove suspicious expressions.

Patch Information

The upstream fix introduces method and property checks in lib/Twig/Sandbox/SecurityPolicy.php, importing SecurityNotAllowedMethodError and SecurityNotAllowedPropertyError and defining a BLOCKED_CLASSES list that includes Pimcore\Model\Dao\AbstractDao, Doctrine\DBAL\Connection, PDO, PDOStatement, and Symfony\Component\DependencyInjection\ContainerInterface. Apply the patch from the Pimcore commit fffa7f6, referenced in Pimcore Pull Request #19193 and the VulnCheck advisory.

Workarounds

Until patching is possible, remove or disable the ability for administrators to author Twig content in DataObject ClassDefinition Layout\Text components.
Replace the stock SecurityPolicy with a hardened policy that rejects calls into AbstractDao, Doctrine\DBAL\Connection, PDO, PDOStatement, and dependency injection containers.
Restrict the pimcore_* Twig function wildcard to an explicit allowlist of functions required by your deployment.

bash

# Verify installed Pimcore version and pull the patched release
composer show pimcore/pimcore | grep versions
composer require pimcore/pimcore:^12 --update-with-dependencies

# Confirm the SecurityPolicy patch is present after upgrade
grep -n "SecurityNotAllowedMethodError" vendor/pimcore/pimcore/lib/Twig/Sandbox/SecurityPolicy.php
grep -n "BLOCKED_CLASSES" vendor/pimcore/pimcore/lib/Twig/Sandbox/SecurityPolicy.php