CVE-2026-55220

CVE-2026-55220 is a PHP deserialization weakness (CWE-502) in the DataObject Hotspotimage field handler of the Pimcore Data & Experience Management Platform: when JSON decoding of the stored __hotspots object-store column fails, Hotspotimage::getDataFromResource() passes the raw column contents to Pimcore\Tool\Serialize::unserialize() with no allowed-classes restriction. Triggering the flaw requires an attacker who already has a separate capability to write crafted PHP-serialized bytes into that column; the payload then fires when an affected DataObject is loaded. Because deserialization is unrestricted, the attacker can instantiate available classes and trigger magic methods, achieving arbitrary file writes or code execution through gadget chains bundled with the application. All Pimcore deployments running versions before 11.5.19, 12.3.10, or 2026.1.6 (per release branch) that use Hotspotimage data-object fields are affected. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS currently puts the 30-day exploitation probability at 0.5%.

What to do: Upgrade to Pimcore 11.5.19, 12.3.10, or 2026.1.6 depending on your release branch. Restrict direct database write access to the DataObject object-store tables (particularly the __hotspots column) and audit which users or integrations hold such access, since exploitation depends on a separate write capability. Note that the June fix changed only the Hotspotimage caller, while ImageGallery, Block, and Video fields retain the same unrestricted-unserialize fallback pattern, so treat those field types as residual risk until a broader fix lands.