CVE-2021-4139

CRITICAL

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affects 1 product across 1 vendor.

CVSS 3.19.0
EPSS0.9%
Percentile59th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, requires user interaction, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-79: Cross-Site Scripting (XSS)

Attacker injects malicious scripts into web pages viewed by other users, executing in the victim's browser context.

Related Attack Patterns (CAPEC)
CAPEC-85 AJAX Footprinting
via CWE-79
CAPEC-209 XSS Using MIME Type Mismatch
via CWE-79
CAPEC-588 DOM-Based XSS
via CWE-79
CAPEC-591 Reflected XSS
via CWE-79
CAPEC-592 Stored XSS
via CWE-79
Show all 6
via CWE-79

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

pimcore is vulnerable to Cross-site Scripting (XSS) due to improper neutralization of input during web page generation, allowing attackers to execute scripts in the context of other users' browsers.

BSID: BS-2021-GLOBAL-071928-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2021-4139?
pimcore is vulnerable to Cross-site Scripting (XSS) due to improper neutralization of input during web page generation, allowing attackers to execute scripts in the context of other users' browsers.
What is the CVSS score for CVE-2021-4139?
CVE-2021-4139 has CVSS 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS: 0.9%.
Is CVE-2021-4139 actively exploited?
No confirmed active exploitation of CVE-2021-4139 as of 2026-05-30.
How do I remediate CVE-2021-4139?
Priority: IMMEDIATE.
What systems are affected by CVE-2021-4139?
CVE-2021-4139 affects Pimcore Pimcore.
Vulnerability Details
CVE IDCVE-2021-4139
BSIDBS-2021-GLOBAL-071928-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Published2021-12-21
Last Modified2024-11-21
ICS Relevance0%
Weakness (CWE)
Cross-Site Scripting (XSS)
SourceNVD
Official Description

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can inject malicious scripts into web pages served by pimcore, which will then be executed in the browser of any user who views the affected page. This can lead to unauthorized actions being performed on behalf of the user, such as session hijacking or data theft.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Pimcore Pimcore < 10.2.7
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1759 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashc99706d58eef7ca2f0f97bbe549a3682389100262670c9a5562c404d83a00e7c3e70857849da874dc2af6fcfafb022d7dbf4034770ad5574a7fcb14700583b23
Related CVEs affecting Pimcore
CVE-2022-39365 9.8 Pimcore is an open source data and experience management platform. Prior to v... CVE-2019-18985 9.8 Pimcore before 6.2.2 lacks brute force protection for the 2FA token. CVE-2019-18981 9.8 Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of... CVE-2024-25625 9.3 Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. A potential... CVE-2024-24822 9.1 Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore....
View all Pimcore CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →