By Null Ventures MCP platform
Menu

vulnerability / NVI-00004023 / Revision 1

Pimcore includes vulnerable PHPOffice/PhpSpreadsheet

OSV carries this publisher advisory for pimcore/data-importer, pimcore/data-importer, pimcore/admin-ui-classic-bundle, pimcore/admin-ui-classic-bundle, pimcore/admin-ui-classic-bundle. This is an aggregated source copy; consult the original publisher and compare update dates.

source listedactiveGHSA-hq76-662x-7mw4

This report has not inspected your inventory, configuration, deployed build, reachability or evidence. A catalog listing and a severity score do not establish exposure or compromise.

01 / Meaning

Why it matters

Published affected context helps an owner decide what evidence to gather. This report has not examined your application.

02 / Applicability

The affected context

Affected versions, configuration prerequisites and known exclusions are public. Confirm each one against the deployed service.

pimcore/data-importer

source listed
  • ECOSYSTEM: introduced 0; fixed 1.8.9

### Summary Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: GHSA-ghg6-32f9-2jp7.

GitHub Advisory Database via OSV

pimcore/data-importer

source listed
  • ECOSYSTEM: introduced 1.9.0; fixed 1.9.3

### Summary Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: GHSA-ghg6-32f9-2jp7.

GitHub Advisory Database via OSV

pimcore/admin-ui-classic-bundle

source listed
  • ECOSYSTEM: introduced 0; fixed 1.3.11

### Summary Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: GHSA-ghg6-32f9-2jp7.

GitHub Advisory Database via OSV

pimcore/admin-ui-classic-bundle

source listed
  • ECOSYSTEM: introduced 1.4.0; fixed 1.4.7

### Summary Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: GHSA-ghg6-32f9-2jp7.

GitHub Advisory Database via OSV

pimcore/admin-ui-classic-bundle

source listed
  • ECOSYSTEM: introduced 1.5.0; fixed 1.5.4

### Summary Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: GHSA-ghg6-32f9-2jp7.

GitHub Advisory Database via OSV

pimcore/pimcore

source listed
  • ECOSYSTEM: introduced 10.6.9.0; fixed 10.6.9.12

### Summary Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: GHSA-ghg6-32f9-2jp7.

GitHub Advisory Database via OSV

pimcore/pimcore

source listed
  • ECOSYSTEM: introduced 11.1.0.0; fixed 11.1.6.11

### Summary Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: GHSA-ghg6-32f9-2jp7.

GitHub Advisory Database via OSV

03 / Response

What to do next

  1. vendor patch

    The original advisory lists fixed boundaries 1.8.9 for pimcore/data-importer. Confirm the publisher’s latest guidance.

    Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system. GitHub Advisory Database via OSV

  2. vendor patch

    The original advisory lists fixed boundaries 1.9.3 for pimcore/data-importer. Confirm the publisher’s latest guidance.

    Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system. GitHub Advisory Database via OSV

  3. vendor patch

    The original advisory lists fixed boundaries 1.3.11 for pimcore/admin-ui-classic-bundle. Confirm the publisher’s latest guidance.

    Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system. GitHub Advisory Database via OSV

  4. vendor patch

    The original advisory lists fixed boundaries 1.4.7 for pimcore/admin-ui-classic-bundle. Confirm the publisher’s latest guidance.

    Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system. GitHub Advisory Database via OSV

  5. vendor patch

    The original advisory lists fixed boundaries 1.5.4 for pimcore/admin-ui-classic-bundle. Confirm the publisher’s latest guidance.

    Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system. GitHub Advisory Database via OSV

  6. vendor patch

    The original advisory lists fixed boundaries 10.6.9.12 for pimcore/pimcore. Confirm the publisher’s latest guidance.

    Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system. GitHub Advisory Database via OSV

  7. vendor patch

    The original advisory lists fixed boundaries 11.1.6.11 for pimcore/pimcore. Confirm the publisher’s latest guidance.

    Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system. GitHub Advisory Database via OSV

A fixed release is not deployment evidence.

Check current vendor support and compatibility. After making a change, verify the deployed build and relevant runtime conditions. Keep the evidence, owner and time. An updated lockfile alone does not prove what is running.

04 / Limits

What this report cannot establish

  • Customer inventory, deployment, reachability and exploitation have not been inspected.
Read the collection and interpretation limits ↗

05 / Provenance

Sources you can inspect

Each assertion retains its source. Mirrored records may repeat one underlying publisher; additional links are not independent corroboration.

  1. GHSA-hq76-662x-7mw4 ↗

    GitHub Advisory Database via OSV · vendor advisory

    Observed . GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.

Public revision history

Only published revisions appear here. Routine fetches do not create a material-change event.

  1. Revision 1 ·

    First indexed by Null; source disclosure date is shown separately.

Read the public revision data ↗

The next step is private

Bring the question into your environment.

The connected workflow is a development preview for inventory, contextual matching, owner decisions and evidence-based verification. No system-specific result is generated by this page.

See the synthetic workflow preview ↗