CVE-2026-5362 — Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering

CVE-2026-5362

Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering PUBLISHED

Description (CNA)

An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution when the published page is rendered. This issue affects pimcore: v12.3.3.

Affected (CNA)

Vendor / product	Versions
pimcore / pimcore	affected v12.3.3

CWE

CWE-79

References

https://fluidattacks.com/es/advisories/mago
https://github.com/pimcore/pimcore/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.