What’s Vulnerable › Vulnerabilities

CVE-2019-18982

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-11-15 · updated 2026-06-17
• Weakness: CWE-79

Description

bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header.

Affected products

• pimcore/pimcore: from 6.0.0 before 6.3.0 — fixed in 6.3.0

How to fix

Upgrade to a fixed version: pimcore/pimcore 6.3.0. Check the vendor advisory for mitigations.

References

• https://github.com/pimcore/pimcore/commit/e0b48faf7d29ce43a98825a0b230e88350ebcf78
• https://github.com/pimcore/pimcore/compare/v6.2.3...v6.3.0
• https://github.com/pimcore/pimcore/commit/e0b48faf7d29ce43a98825a0b230e88350ebcf78
• https://github.com/pimcore/pimcore/compare/v6.2.3...v6.3.0

Get alerted when CVE-2019-18982 or the next vulnerability affects your stack