UpHeron
All vulnerabilities

Servers and applications

CVE-2021-39166

Improper Neutralization of Text-Values in Object Version Preview

Severity
Medium 5.4
Published
1 Sept 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
10.1.1, 10.1.2
Also known as
GHSA-w6j8-jc36-x5q9
Sources
NVD, Project advisories (GitHub)

Description

Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources. This issue is patched in Pimcore version 10.1.2.

Affected software

SoftwareAffected versions
PimcoreServers and applications · cpe:a:pimcore:pimcore
  • Every version before 10.1.2
PimcoreServers and applications · github:pimcore/pimcore
  • Every version before 10.1.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-39166
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-39166
  • GitHub Advisory Database https://github.com/advisories/GHSA-w6j8-jc36-x5q9
  • github.com https://github.com/pimcore/pimcore/security/advisories/GHSA-w6j8-jc36-x5q9