CVE-2026-11407: Pimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed

Synopsis

This is a Twig sandbox bypass vulnerability in Pimcore CMS/DXP version 12.3.8 and earlier. An authenticated attacker with administrative privileges can reach the vulnerable component over the network by supplying crafted Twig templates through the DataObject ClassDefinition Layout\Text component, exploiting empty checkMethodAllowed() and checkPropertyAllowed() implementations in Pimcore's custom Twig SecurityPolicy to call arbitrary PHP object methods. Successful exploitation enables arbitrary file reads, arbitrary database query execution, and remote code execution via PHP object gadget chains. A patched-image rebuild pinned to the fix commit (fffa7f6396329e88610db70a8652529bbc734892) is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Pimcore application over the network; the vulnerable template rendering endpoint is exposed via standard HTTP/HTTPS.

• AuthenticationRequired

  An administrative account is required; the attacker must authenticate before accessing the DataObject ClassDefinition Layout editor where malicious templates can be submitted.

• Victim interactionNot required

  No victim interaction is needed; the attacker submits the crafted Twig template directly and the payload executes server-side without any secondary user action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no race conditions or special environmental prerequisites beyond holding an admin credential.

Blast Radius

• Reads arbitrary files from the server filesystem, including application secrets, environment configuration files, and private keys accessible to the web process.
• Executes arbitrary database queries against the Pimcore database, exposing or modifying stored content, user records, and application data.
• Achieves remote code execution by chaining PHP object methods through gadget chains available in the application's dependency tree.
• Fully compromises the integrity and confidentiality of the CMS instance, with all three impact dimensions (confidentiality, integrity, availability) rated HIGH in the CVSS v4.0 vector.