CVE-2026-55220: Pimcore Hotspotimage RCE Vulnerability

CVE-2026-55220 Overview

CVE-2026-55220 is an insecure deserialization vulnerability [CWE-502] in Pimcore, an open-source data and experience management platform. The flaw resides in Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource() inside models/DataObject/ClassDefinition/Data/Hotspotimage.php. The function passes the __hotspots object-store column to Pimcore\Tool\Serialize::unserialize() without an allowed-classes restriction when JSON decoding fails. An attacker able to write crafted PHP serialized bytes into that column can instantiate arbitrary available classes and trigger magic methods when the affected DataObject loads.

Critical Impact
Successful exploitation enables arbitrary file writes or remote code execution through bundled PHP gadget chains, leading to full compromise of the Pimcore application host.

Affected Products

Pimcore versions prior to 11.5.19
Pimcore versions prior to 12.3.10
Pimcore versions prior to 2026.1.6

Discovery Timeline

2026-08-28 - CVE-2026-55220 published to the National Vulnerability Database (NVD)
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-55220

Vulnerability Analysis

The vulnerability is a PHP object injection flaw in the Hotspotimage data type handler. When Pimcore loads a DataObject, getDataFromResource() reads the __hotspots column and first attempts a json_decode(). If JSON parsing returns a falsy result, the code falls back to Serialize::unserialize() on the raw column content without constraining permitted classes.

PHP's unserialize() reconstructs any class available in the application's autoloader. Pimcore bundles multiple libraries that expose usable magic methods such as __destruct, __wakeup, and __toString. Chained together, these methods form gadget chains capable of writing files or executing arbitrary code within the web application's context.

The advisory notes that ImageGallery, Block, and Video data type callers follow the same fallback pattern. The June fix only remediates the Hotspotimage caller; the other call sites remain outside the scope of this CVE.

Root Cause

The root cause is invocation of Serialize::unserialize() without an allowed_classes allow-list on attacker-influenceable input. This matches the classic Insecure Deserialization pattern classified under [CWE-502].

Attack Vector

Exploitation requires a secondary write primitive that lets the attacker place crafted serialized bytes into the __hotspots object-store column. When any user or background job subsequently loads the affected DataObject, deserialization triggers the gadget chain. The attack traverses the network with no user interaction and no privileges once the write primitive is available.

php

             // check if the data is JSON (backward compatibility)
             $md = json_decode($metaData, true);
             if (!$md) {
-                $md = Serialize::unserialize($metaData);
+                $md = Serialize::unserialize($metaData, [Element\Data\MarkerHotspotItem::class]);
             } elseif (is_array($md)) {
                 $md['hotspots'] = $md;
             }

Source: Pimcore commit b184c01. The patch restricts deserialization to a single allow-listed class, Element\Data\MarkerHotspotItem, preventing instantiation of gadget classes.

Detection Methods for CVE-2026-55220

Indicators of Compromise

Unexpected PHP files, webshells, or scheduled tasks appearing under the Pimcore web/, var/, or public/ directories after DataObject load events.
Anomalous child processes spawned by the PHP-FPM or web server user, such as sh, bash, python, or outbound network utilities.
Serialized PHP payload patterns (for example, strings beginning with O: or C:) written into the __hotspots column of object_store_* database tables.

Detection Strategies

Audit the object_store_* tables for __hotspots values that are not valid JSON and contain PHP serialization markers.
Enable PHP error and application logging around Pimcore\Tool\Serialize::unserialize() to capture unexpected class instantiations.
Correlate DataObject load events with subsequent file creation or process execution on the host to identify gadget chain activity.

Monitoring Recommendations

Monitor web server and PHP-FPM processes for anomalous command execution using endpoint detection and response tooling.
Alert on outbound connections initiated by the PHP runtime to non-approved destinations.
Track modifications to Pimcore application directories and bundled vendor libraries with file integrity monitoring.

How to Mitigate CVE-2026-55220

Immediate Actions Required

Upgrade Pimcore to 11.5.19, 12.3.10, or 2026.1.6 depending on your release branch.
Restrict database write access so that only the Pimcore application account can modify object_store_* tables.
Review recent changes to the __hotspots column for suspicious serialized payloads and quarantine affected DataObjects.

Patch Information

The fix is delivered in Pimcore v12.3.10, Pimcore v2026.1.6, and the corresponding 11.5.19 release. The remediation is implemented in pull request #19181 and details are documented in the GitHub Security Advisory GHSA-w23p-wrp7-ch38. The patch constrains Serialize::unserialize() to the Element\Data\MarkerHotspotItem class only.

Workarounds

If patching is not immediately possible, harden database credentials and network segmentation so that only trusted services can write to Pimcore's storage tables.
Deploy web application firewall rules to block requests attempting to inject serialized PHP payloads into DataObject fields.
Sanitize existing __hotspots values by validating them as JSON and rejecting entries containing PHP serialization markers.

bash

# Upgrade Pimcore via Composer to a patched release
composer require pimcore/pimcore:^12.3.10 --with-all-dependencies
# Clear caches after upgrade
bin/console cache:clear