CVE-2019-10867

An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.

• CWE-502

• http://packetstormsecurity.com/files/152667/Pimcore-Unserialize-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://www.rapid7.com/db/modules/exploit/multi/http/pimcore_unserialize_rceThird Party Advisory
• https://blog.certimetergroup.com/it/articolo/security/polyglot_phar_deserialization_to_rce
• https://github.com/pimcore/pimcore/commit/38a29e2f4f5f060a73974626952501cee05fda73Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-173998Exploit, Third Party Advisory
• https://www.exploit-db.com/exploits/46783/Exploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/152667/Pimcore-Unserialize-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://www.rapid7.com/db/modules/exploit/multi/http/pimcore_unserialize_rceThird Party Advisory
• https://blog.certimetergroup.com/it/articolo/security/polyglot_phar_deserialization_to_rce
• https://github.com/pimcore/pimcore/commit/38a29e2f4f5f060a73974626952501cee05fda73Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-173998Exploit, Third Party Advisory
• https://www.exploit-db.com/exploits/46783/Exploit, Third Party Advisory, VDB Entry

Published

Apr 4, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10855Computrols CBAS 18.0.0 mishandles password hashes. The appro…
• CVE-2019-10856In Jupyter Notebook before 5.7.8, an open redirect can occur…
• CVE-2019-1086An elevation of privilege exists in Windows Audio Service, a…
• CVE-2019-10863A command injection vulnerability exists in TeemIp versions …
• CVE-2019-10864The WP Statistics plugin through 12.6.2 for WordPress has XS…
• CVE-2019-10866In the Form Maker plugin before 1.13.3 for WordPress, it's p…
• CVE-2019-10868In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21…6.5
• CVE-2019-10869Path Traversal and Unrestricted File Upload exists in the Ni…8.1
• CVE-2019-1087An elevation of privilege exists in Windows Audio Service, a…
• CVE-2019-10871An issue was discovered in Poppler 0.74.0. There is a heap-b…
• CVE-2019-10872An issue was discovered in Poppler 0.74.0. There is a heap-b…
• CVE-2019-10873An issue was discovered in Poppler 0.74.0. There is a NULL p…