### Impact
The impact of this path traversal and arbitrary extension is limited (creation of arbitrary files and appending data to existing files) but when combined with the SQL Injection, the exported data `RESTRICTED DIFFUSION 9 / 9` can be controlled and a webshell can be uploaded. Attackers can use that to execute arbitrary PHP code on the server with the permissions of the webserver.

### Patches
Update to version 10.5.18 or apply this patch manually https://github.com/pimcore/pimcore/commit/7f788fa44bc18bc1c9182c25e26b770a1d30b62f.patch

### Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/7f788fa44bc18bc1c9182c25e26b770a1d30b62f.patch manually.

### References
https://github.com/pimcore/pimcore/pull/14498

Affected Packages

Packagist pimcore/pimcore

Affected versions: 0 (fixed in 10.5.18)

Related CVEs

CVE-2023-30855

Key Information

GHSA ID

GHSA-g2mc-fqqc-hxg3

Published

May 2, 2023 4:43 PM

Last Modified

May 9, 2023 4:38 PM

CVSS Score

5.0 /10

Primary Ecosystem

Packagist

Primary Package

pimcore/pimcore

GitHub Reviewed

✓ Yes

Dataset

Last updated: November 26, 2025 6:30 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.