UpHeron
All vulnerabilities

Servers and applications

CVE-2023-23937

Missing file upload type validation in user profile

Severity
Medium 5.4
Published
1 Feb 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
10.5.16
Also known as
GHSA-8xv4-jj4h-qww6
Sources
NVD, Project advisories (GitHub)

Description

Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. The upload functionality for updating user profile does not properly validate the file content-type, allowing any authenticated user to bypass this security check by adding a valid signature (p.e. GIF89) and sending any invalid content-type. This could allow an authenticated attacker…

Affected software

SoftwareAffected versions
PimcoreServers and applications · cpe:a:pimcore:pimcore
  • Every version before 10.5.16
PimcoreServers and applications · github:pimcore/pimcore
  • Every version before 10.5.16

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-23937
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-23937
  • GitHub Advisory Database https://github.com/advisories/GHSA-8xv4-jj4h-qww6
  • github.com https://github.com/pimcore/pimcore/security/advisories/GHSA-8xv4-jj4h-qww6