LoginSign Up
← Back to all sparks
P

Pimcore

MKT AUTO
Velocity5.0

Open-source data and experience management platform (PIM, MDM, DAM, CMS)

pimcore.com ↗

Pimcore 2026.3.5 tightens permission checks across WebDAV, previews and versions.

pimdamsecurity-patchaccess-controlphp
◆Current state
Pimcore 2026.3.5 mixes bug fixes for video assets, field collections, classification stores and grid filters with a set of permission hardening changes. WebDAV now enforces per-asset permissions, draft substitution and object studio previews require the right permissions, and password field values are masked in the editmode payload. It follows a security-heavy October.
◆Where it's heading
The 2026.3 line has settled into weekly patches where security hardening and data-model fixes share each release. Access-control checks keep spreading to paths that were missed, such as WebDAV and preview endpoints.
◆Prediction
Expect weekly 2026.3.x patches to continue with more permission checks and fixes, until a 2026.4 minor brings new features.

◆Recent moves

  1. 3d ago

    Pimcore 2026.3.5: WebDAV permission checks and asset fixes

    The patch adds permission checks to WebDAV, draft previews and studio previews, and masks password values in editmode. With fixes to video assets and field collections, it continues the line's mix of hardening and repair.

    View source ↗
  2. 10d ago

    Pimcore 2026.3.4: localized-field and editor bug fixes

    A maintenance patch fixing localized fields that blocked publishing, duplicated field containers, and links to unpublished elements in the WYSIWYG editor. It includes the Twig sandbox restriction from 2026.3.3.1 and marks a return to routine fixes after three security-led patches.

    View source ↗
  3. 23d ago

    2026.3.3.1: Twig sandbox can no longer reach request or dump

    A one-fix hotfix that stops Twig templates from reaching the request object and pimcore_dump. It is the second Twig sandbox fix this month, after 2026.3.2, so admins who let editors write templates should take it.

    View source ↗
  4. 25d ago

    2026.3.3: SQL-denylist and unserialize fixes, lighter relations

    The third straight patch with security advisories, here a quote-nesting bypass of the Custom Reports SQL denylist and PHP object injection through session tmp_store data. Alongside sit performance changes, a lightweight ManyToMany loader and skipping unused calculated values, and atomic job counting so the Generic Execution Engine finishes with several workers.

    View source ↗
  5. 1mo ago

    Pimcore 2026.3.2 patches IDOR, Twig sandbox bypass, object injection

    The second 2026.3 patch is mostly security: an IDOR that let scheduled version publishing overwrite arbitrary elements, a Twig sandbox bypass enabling file read and delete, unsafe link HTML, and PHP object injection through date properties. It is the second Twig sandbox fix in the window after 2026.2.8, and the advisory count makes this a must-upgrade patch.

    View source ↗
  6. 1mo ago

    Pimcore 2026.3.1: per-type version storage, focal-point fixes

    The first 2026.3 patch lets teams store versions in different storage per element type and skip versioning on asset upload. It also sanitizes generated model class descriptions. It continues the storage-flexibility work of recent releases.

    View source ↗