CVE-2022-39365

CRITICAL

Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in `Pimcore/Mail` & `ClassDefinition\Layout\Text` is vulnera...

Affects 1 product across 1 vendor.

CVSS 3.19.8
EPSS1.8%
Percentile78th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-94: Code Injection

Attacker injects arbitrary code that is executed by the application process.

Related Attack Patterns (CAPEC)
CAPEC-35 Leverage Executable Code in Non-Executable Files
via CWE-94
CAPEC-77 Manipulating User-Controlled Variables
via CWE-94
CAPEC-242 Code Injection
via CWE-94

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

Pimcore versions prior to 10.5.9 are vulnerable to server-side template injection due to user-controlled Twig templates in Pimcore/Mail and ClassDefinition\Layout\Text, which could lead to remote code execution.

BSID: BS-2022-GLOBAL-331526-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2022-39365?
Pimcore versions prior to 10.5.9 are vulnerable to server-side template injection due to user-controlled Twig templates in Pimcore/Mail and ClassDefinition\Layout\Text, which could lead to remote code execution.
What is the CVSS score for CVE-2022-39365?
CVE-2022-39365 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 1.8%.
Is CVE-2022-39365 actively exploited?
No confirmed active exploitation of CVE-2022-39365 as of 2026-09-25.
How do I remediate CVE-2022-39365?
Priority: IMMEDIATE.
What systems are affected by CVE-2022-39365?
CVE-2022-39365 affects Pimcore Pimcore.
Vulnerability Details
CVE IDCVE-2022-39365
BSIDBS-2022-GLOBAL-331526-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2022-10-27
Last Modified2026-06-17
ICS Relevance15%
Weakness (CWE)
Code Injection
SourceNVD
Official Description

Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in `Pimcore/Mail` & `ClassDefinition\Layout\Text` is vulnerable to server-side template injection, which could lead to remote code execution. Version 10.5.9 contains a patch for this issue. As a workaround, one may apply the patch manually.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by injecting malicious Twig code into templates that are rendered by Pimcore. This can result in arbitrary code execution on the server.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Pimcore Pimcore < 10.5.9
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1449 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hashf3418c4805600a761dcaecf2fa1dd1827361039ee3ac1d0654592d069d11eed07bc7ed57649dba9f7452c9f45e6e36cd20e7a87e5ba5db771cb01c5947329e22
Related CVEs affecting Pimcore
CVE-2019-18981 9.8 Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of... CVE-2019-18985 9.8 Pimcore before 6.2.2 lacks brute force protection for the 2FA token. CVE-2024-25625 9.3 Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. A potential... CVE-2024-24822 9.1 Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore.... CVE-2021-4139 9.0 pimcore is vulnerable to Improper Neutralization of Input During Web Page Gen...
View all Pimcore CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →