CVE-2019-10867: Pimcore PHP object deserialization RCE via bulk-commit endpoint

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityNetwork-reachable deserialization to RCE with public exploit code and very high EPSS, though it requires an authenticated account with classes permission.

What it is

Pimcore before 5.7.1 passes untrusted input from the data parameter of a POST to /admin/class/bulk-commit into PHP's unserialize function in ClassController.php. This is a CWE-502 deserialization of untrusted data flaw that can lead to remote code execution on the server. It matters because the endpoint is reachable over the network and public exploit code exists.

Impact

An attacker with classes permission can execute arbitrary code on the Pimcore server, gaining full control of the application and its data. CVSS 3.0 scores it 8.8 (high) for confidentiality, integrity and availability impact.

Attack surface

Reached over the network via an HTTP POST to /admin/class/bulk-commit; the CVSS vector requires low privileges (PR:L) and no user interaction (UI:N). The attacker must hold the classes permission in Pimcore, so it is not unauthenticated.

Exploitation

Not listed in CISA KEV, but EPSS 30-day probability is 0.68874 (99.3rd percentile) and multiple references are tagged Exploit, including Packet Storm, Exploit-DB and a Rapid7 Metasploit module. Public exploit code is therefore available.

What to do

• Upgrade Pimcore to 5.7.1 or later, which contains the patch commit 38a29e2f4f5f060a73974626952501cee05fda73.
• If immediate upgrade is not possible, restrict access to /admin/class/bulk-commit and the admin interface to trusted networks or IPs.
• Review and minimize which accounts hold the classes permission, and audit those accounts for unexpected activity.
• Avoid passing user-controlled data into unserialize; where feasible, apply input validation or a safe deserialization allowlist as a compensating control.

Detection

• Monitor web logs for POST requests to /admin/class/bulk-commit, especially with serialized-looking data parameter values.
• Alert on PHP process behavior consistent with deserialization exploitation, such as unexpected child processes or outbound connections from the web server.
• Audit Pimcore admin accounts with classes permission for anomalous or off-hours use of class management endpoints.
• Search for known exploit payload patterns or tooling artifacts tied to the public Pimcore unserialize RCE exploits.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.