CVE-2021-39166: Improper Neutralization of Text-Values in Object Version Preview

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-01 · updated 2026-06-17
Weakness: CWE-79

Description

Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources. This issue is patched in Pimcore version 10.1.2.

Affected products

pimcore/pimcore: before 10.1.2 — fixed in 10.1.2

How to fix

Upgrade to a fixed version: pimcore/pimcore 10.1.2. Check the vendor advisory for mitigations.

References

https://github.com/pimcore/pimcore/pull/10170
https://github.com/pimcore/pimcore/security/advisories/GHSA-w6j8-jc36-x5q9
https://github.com/pimcore/pimcore/pull/10170
https://github.com/pimcore/pimcore/security/advisories/GHSA-w6j8-jc36-x5q9

Get alerted when CVE-2021-39166 or the next vulnerability affects your stack