CVE-2022-0832: Pimcore stored XSS before 10.3.3

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityCVSS rates it medium (5.4) and it requires privileges plus user interaction, but the very high EPSS percentile and public exploit reference raise the practical urgency.

What it is

Pimcore versions prior to 10.3.3 contain a stored cross-site scripting flaw (CWE-79) in the GitHub repository pimcore/pimcore. Injected script content persists and executes in the browsers of users who view the affected page, so it matters for any deployment where untrusted content reaches stored fields. The record gives no further detail on the specific vulnerable component or input.

Impact

An attacker can run script in the context of a victim's session, enabling session or data theft and actions performed as the victim. The CVSS scope change (S:C) indicates the impact can extend beyond the vulnerable component.

Attack surface

Reachable over the network (AV:N) with low attack complexity, but it requires low privileges (PR:L) and user interaction (UI:R) for the victim to trigger the stored payload. No authentication bypass is implied; the attacker needs an account able to store the malicious content.

Exploitation

Not listed in CISA KEV, but EPSS is 0.6662 (99.25th percentile), indicating elevated predicted exploitation activity. The references include an Exploit-tagged huntr bounty and a patch commit, so public proof-of-concept detail likely exists.

What to do

• Upgrade Pimcore to 10.3.3 or later, applying the referenced patch commit.
• Restrict accounts that can create or edit stored content to trusted users and review existing roles.
• Apply output encoding and input sanitization for stored fields, and enforce a Content Security Policy to limit script execution.
• Review stored content for injected script payloads and remove any found.

Detection

• Search application and web logs for requests containing script tags or event-handler attributes in stored fields.
• Monitor for anomalous script execution or unexpected outbound requests from authenticated Pimcore sessions.
• Audit stored content records for HTML/JavaScript payloads introduced around suspicious edit times.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.