Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2015-4426: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter to admin/asset/grid-proxy.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2015-08-18T17:59Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: pimcore/modules/admin/controllers/AssetController.php
Commit date: 2015-04-20 08:40:08 +0000
Commit message: fixed sql injection issue

git-svn-id: http://www.pimcore.org/svn/pimcore/private/core/trunk@6460 1f8fe7d8-47f0-464c-8d0a-336f4953ab05

Diff: diff --git a/pimcore/modules/admin/controllers/AssetController.php b/pimcore/modules/admin/controllers/AssetController.php
index e897b8d3f..43b1ac91e 100644
--- a/pimcore/modules/admin/controllers/AssetController.php
+++ b/pimcore/modules/admin/controllers/AssetController.php
@@ -1582,11 +1582,12 @@ class Admin_AssetController extends \Pimcore\Controller\Action\Admin\Element
         if ($this->getParam("data")) {
             if ($this->getParam("xaction") == "update") {
                 //TODO probably not needed
             }
         } else {
-            // get list of objects
+            $db = \Pimcore\Resource::get();
+                // get list of objects
             $folder = Asset::getById($this->getParam("folderId"));
 
 
             $start = 0;
             $limit = 20;
@@ -1663,11 +1664,11 @@ class Admin_AssetController extends \Pimcore\Controller\Action\Admin\Element
                     $field = "`" . $filter["field"] . "` ";
                     if($filter["field"] == "fullpath") {
                         $field = "CONCAT(path,filename)";
                     }
 
-                    $conditionFilters[] =  $field . $operator . " '" . $value . "' ";
+                    $conditionFilters[] =  $field . $operator . " " . $db->quote($value);
                 }
             }
 
             $list = new Asset\Listing();
             $condition = implode(" AND ", $conditionFilters);

Vulnerable code:             // get list of objects
                    $conditionFilters[] =  $field . $operator . " '" . $value . "' ";
Fixed code:             $db = \Pimcore\Resource::get();
                // get list of objects
                    $conditionFilters[] =  $field . $operator . " " . $db->quote($value);
CVE-2019-16317: Deserialization of Untrusted Data (CWE-502)
value: In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../var/www/html/web/var/assets/ directory, a different vulnerability than CVE-2019-10867 and CVE-2019-16318.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 8.8
Published: 2019-09-14T18:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: models/Asset.php
Commit date: 2019-03-19 14:59:24 +0100
Commit message: [Asset] do not allow PHAR upload

Diff: diff --git a/models/Asset.php b/models/Asset.php
index 4d28af150f..c8fe1004ce 100644
--- a/models/Asset.php
+++ b/models/Asset.php
@@ -617,11 +617,11 @@ class Asset extends Element\AbstractElement
             $this->setFilename('');
             $this->setType('folder');
         }
 
         // do not allow PHP and .htaccess files
-        if (preg_match("@\.ph(p[\d+]?|t|tml|ps)$@i", $this->getFilename()) || $this->getFilename() == '.htaccess') {
+        if (preg_match("@\.ph(p[\d+]?|t|tml|ps|ar)$@i", $this->getFilename()) || $this->getFilename() == '.htaccess') {
             $this->setFilename($this->getFilename() . '.txt');
         }
 
         if(mb_strlen($this->getFilename()) > 255) {
             throw new \Exception('Filenames longer than 255 characters are not allowed');

Vulnerable code:         if (preg_match("@\.ph(p[\d+]?|t|tml|ps)$@i", $this->getFilename()) || $this->getFilename() == '.htaccess') {
Fixed code:         if (preg_match("@\.ph(p[\d+]?|t|tml|ps|ar)$@i", $this->getFilename()) || $this->getFilename() == '.htaccess') {
CVE-2019-16318: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vulnerability than CVE-2019-10867 and CVE-2019-16317.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 8.8
Published: 2019-09-14T18:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: models/Asset.php
Commit date: 2019-03-19 14:56:35 +0100
Commit message: [Asset] do not allow filenames longer than 255 characters

Diff: diff --git a/models/Asset.php b/models/Asset.php
index f43fd585ac..4d28af150f 100644
--- a/models/Asset.php
+++ b/models/Asset.php
@@ -621,10 +621,14 @@ class Asset extends Element\AbstractElement
         // do not allow PHP and .htaccess files
         if (preg_match("@\.ph(p[\d+]?|t|tml|ps)$@i", $this->getFilename()) || $this->getFilename() == '.htaccess') {
             $this->setFilename($this->getFilename() . '.txt');
         }
 
+        if(mb_strlen($this->getFilename()) > 255) {
+            throw new \Exception('Filenames longer than 255 characters are not allowed');
+        }
+
         if (Asset\Service::pathExists($this->getRealFullPath())) {
             $duplicate = Asset::getByPath($this->getRealFullPath());
             if ($duplicate instanceof Asset and $duplicate->getId() != $this->getId()) {
                 throw new \Exception('Duplicate full path [ ' . $this->getRealFullPath() . ' ] - cannot save asset');
             }

Fixed code:         if(mb_strlen($this->getFilename()) > 255) {
            throw new \Exception('Filenames longer than 255 characters are not allowed');
        }
CVE-2019-18656: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Pimcore 6.2.3 has XSS in the translations grid because bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js mishandles certain HTML elements.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-10-31T17:15Z
Repository: https://github.com/pimcore/pimcore
Language: JavaScript
Files changed: bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js
Commit date: 2019-10-30 14:15:19 +0100
Commit message: Fixed possible XSS in the translations grid

Diff: diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js b/bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js
index 757ccde31f..cebeffc55a 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js
@@ -100,10 +100,13 @@ pimcore.settings.translations = Class.create({
                 text: pimcore.available_languages[languages[i]],
                 sortable: true,
                 dataIndex: "_" + languages[i],
                 filter: 'string',
                 getEditor: this.getCellEditor.bind(this, languages[i]),
+                renderer: function (text) {
+                    return replace_html_event_attributes(strip_tags(text, 'div,span,b,strong,em,i,small,sup,sub,p'));
+                },
                 id: "translation_column_" + this.translationType + "_" + languages[i].toLowerCase()
             };
             if (applyInitialSettings) {
                 var hidden = i >= maxLanguages;
                 columnConfig.hidden = hidden;

Fixed code:                 renderer: function (text) {
                    return replace_html_event_attributes(strip_tags(text, 'div,span,b,strong,em,i,small,sup,sub,p'));
                },
CVE-2019-18981: Inappropriate Encoding for Output Context (CWE-838)
value: Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.
CWE description: The product uses or specifies an encoding when generating output to a downstream component, but the specified encoding is not the same as the encoding that is expected by the downstream component.
CVSS v3 base score: 9.8
Published: 2019-11-15T05:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: models/Notification/Service/NotificationService.php
Commit date: 2019-10-21 17:48:57 +0200
Commit message: Notifications: do additional checks

Diff: diff --git a/models/Notification/Service/NotificationService.php b/models/Notification/Service/NotificationService.php
index 26ee8c3392..4aad2477e2 100644
--- a/models/Notification/Service/NotificationService.php
+++ b/models/Notification/Service/NotificationService.php
@@ -18,10 +18,11 @@ namespace Pimcore\Model\Notification\Service;
 
 use Pimcore\Model\Element\ElementInterface;
 use Pimcore\Model\Notification;
 use Pimcore\Model\Notification\Listing;
 use Pimcore\Model\User;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 
 class NotificationService
 {
     /** @var UserService */
     private $userService;
@@ -144,10 +145,14 @@ class NotificationService
     public function findAndMarkAsRead(int $id, ?int $recipientId = null): Notification
     {
         $this->beginTransaction();
         $notification = $this->find($id);
 
+        if($notification->getRecipient()->getId() != $recipientId) {
+            throw new AccessDeniedHttpException();
+        }
+
         if ($recipientId && $recipientId == $notification->getRecipient()->getId()) {
             $notification->setRead(true);
             $notification->save();
             $this->commit();
         }

Fixed code: use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
        if($notification->getRecipient()->getId() != $recipientId) {
            throw new AccessDeniedHttpException();
        }
CVE-2019-18981: Insufficient Information (NVD-CWE-noinfo)
value: Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2019-11-15T05:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: models/Notification/Service/NotificationService.php
Commit date: 2019-10-21 17:48:57 +0200
Commit message: Notifications: do additional checks

Diff: diff --git a/models/Notification/Service/NotificationService.php b/models/Notification/Service/NotificationService.php
index 26ee8c3392..4aad2477e2 100644
--- a/models/Notification/Service/NotificationService.php
+++ b/models/Notification/Service/NotificationService.php
@@ -18,10 +18,11 @@ namespace Pimcore\Model\Notification\Service;
 
 use Pimcore\Model\Element\ElementInterface;
 use Pimcore\Model\Notification;
 use Pimcore\Model\Notification\Listing;
 use Pimcore\Model\User;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 
 class NotificationService
 {
     /** @var UserService */
     private $userService;
@@ -144,10 +145,14 @@ class NotificationService
     public function findAndMarkAsRead(int $id, ?int $recipientId = null): Notification
     {
         $this->beginTransaction();
         $notification = $this->find($id);
 
+        if($notification->getRecipient()->getId() != $recipientId) {
+            throw new AccessDeniedHttpException();
+        }
+
         if ($recipientId && $recipientId == $notification->getRecipient()->getId()) {
             $notification->setRead(true);
             $notification->save();
             $this->commit();
         }

Fixed code: use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
        if($notification->getRecipient()->getId() != $recipientId) {
            throw new AccessDeniedHttpException();
        }
CVE-2019-18982: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-11-15T05:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: bundles/AdminBundle/Controller/Admin/EmailController.php
Commit date: 2019-10-30 17:00:19 +0100
Commit message: [Email] Email log: do not allow script/iframe execution in preview window

Diff: diff --git a/bundles/AdminBundle/Controller/Admin/EmailController.php b/bundles/AdminBundle/Controller/Admin/EmailController.php
index 15002770f59..ff08a3bbc79 100644
--- a/bundles/AdminBundle/Controller/Admin/EmailController.php
+++ b/bundles/AdminBundle/Controller/Admin/EmailController.php
@@ -131,11 +131,13 @@ class EmailController extends AdminController
         if ($request->get('type') == 'text') {
             $templatingEnginePhp = $this->get('pimcore.templating.engine.php');
 
             return new Response('<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><style>body{background-color:#fff;}</style></head><body><pre>' . $templatingEnginePhp->escape($emailLog->getTextLog()) . '</pre></body></html>');
         } elseif ($request->get('type') == 'html') {
-            return new Response($emailLog->getHtmlLog());
+            return new Response($emailLog->getHtmlLog(), 200, [
+                'Content-Security-Policy' => "default-src 'self'; style-src 'self' 'unsafe-inline'"
+            ]);
         } elseif ($request->get('type') == 'params') {
             try {
                 $params = $this->decodeJson($emailLog->getParams());
             } catch (\Exception $e) {
                 Logger::warning('Could not decode JSON param string');

Vulnerable code:             return new Response($emailLog->getHtmlLog());
Fixed code:             return new Response($emailLog->getHtmlLog(), 200, [
                'Content-Security-Policy' => "default-src 'self'; style-src 'self' 'unsafe-inline'"
            ]);
CVE-2021-23340: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authenticated user can reach this function with a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename]. Since exportFile variable is not sanitized, an attacker can exploit a local file inclusion vulnerability.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.1
Published: 2021-02-18T15:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: bundles/AdminBundle/Controller/Reports/CustomReportController.php
Commit date: 2021-02-05 10:39:02 +0100
Commit message: Fixed LFI in custom report csv download

Diff: diff --git a/bundles/AdminBundle/Controller/Reports/CustomReportController.php b/bundles/AdminBundle/Controller/Reports/CustomReportController.php
index 37a19734fb6..0d859cdb8ac 100644
--- a/bundles/AdminBundle/Controller/Reports/CustomReportController.php
+++ b/bundles/AdminBundle/Controller/Reports/CustomReportController.php
@@ -431,11 +431,11 @@ class CustomReportController extends ReportsControllerBase
 
         $progress = $result['total'] ? ($offset * $limit) / $result['total'] : 1;
         $progress = $progress > 1 ? 1 : $progress;
 
         return new JsonResponse([
-            'exportFile' => $exportFile,
+            'exportFile' => basename($exportFile),
             'offset' => $offset,
             'progress' => $progress,
             'finished' => empty($result['data']) || count($result['data']) < $limit,
         ]);
     }
@@ -449,10 +449,11 @@ class CustomReportController extends ReportsControllerBase
      */
     public function downloadCsvAction(Request $request)
     {
         $this->checkPermission('reports');
         if ($exportFile = $request->get('exportFile')) {
+            $exportFile = PIMCORE_SYSTEM_TEMP_DIRECTORY . '/' . basename($exportFile);
             $response = new BinaryFileResponse($exportFile);
             $response->headers->set('Content-Type', 'text/csv; charset=UTF-8');
             $response->setContentDisposition(ResponseHeaderBag::DISPOSITION_ATTACHMENT, 'export.csv');
             $response->deleteFileAfterSend(true);
 

Vulnerable code:             'exportFile' => $exportFile,
Fixed code:             'exportFile' => basename($exportFile),
            $exportFile = PIMCORE_SYSTEM_TEMP_DIRECTORY . '/' . basename($exportFile);
CVE-2022-0251: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.10.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-01-26T11:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: models/DataObject/ClassDefinition/Service.php
Commit date: 2022-01-25 12:20:25 +0100
Commit message: disallow html entity names on import - follow up to #11217

Diff: diff --git a/models/DataObject/ClassDefinition/Service.php b/models/DataObject/ClassDefinition/Service.php
index 46ba9941366..4208f1e09f8 100644
--- a/models/DataObject/ClassDefinition/Service.php
+++ b/models/DataObject/ClassDefinition/Service.php
@@ -313,15 +313,15 @@ class Service
      */
     public static function generateLayoutTreeFromArray($array, $throwException = false, $insideLocalizedField = false)
     {
         if (is_array($array) && count($array) > 0) {
             if ($name = $array['name'] ?? false) {
-                $sanitizedName = htmlentities($name);
-                if ($sanitizedName !== $name) {
+                if (preg_match('/<.+?>/', $name)) {
                     throw new \Exception('not a valid name:' . htmlentities($name));
                 }
             }
+
             /** @var LoaderInterface $loader */
             $loader = \Pimcore::getContainer()->get('pimcore.implementation_loader.object.' . $array['datatype']);
 
             if ($loader->supports($array['fieldtype'])) {
                 /** @var Data|Layout $item */

Vulnerable code:                 $sanitizedName = htmlentities($name);
                if ($sanitizedName !== $name) {
Fixed code:                 if (preg_match('/<.+?>/', $name)) {
CVE-2022-0263: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 7.8
Published: 2022-01-18T16:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: bundles/AdminBundle/Controller/Admin/SettingsController.php
Commit date: 2022-01-17 16:52:05 +0100
Commit message: [Settings] Validate SVG uploads for branding

Diff: diff --git a/bundles/AdminBundle/Controller/Admin/SettingsController.php b/bundles/AdminBundle/Controller/Admin/SettingsController.php
index b706d5eb1bd..eeaec96a597 100644
--- a/bundles/AdminBundle/Controller/Admin/SettingsController.php
+++ b/bundles/AdminBundle/Controller/Admin/SettingsController.php
@@ -107,10 +107,16 @@ class SettingsController extends AdminController
         $fileExt = File::getFileExtension($_FILES['Filedata']['name']);
         if (!in_array($fileExt, ['svg', 'png', 'jpg'])) {
             throw new \Exception('Unsupported file format');
         }
 
+        if($fileExt === 'svg') {
+            if(strpos(file_get_contents($_FILES['Filedata']['tmp_name']), '<script')) {
+                throw new \Exception('Scripts in SVG files are not supported');
+            }
+        }
+
         $storage = Tool\Storage::get('admin');
         $storage->writeStream(self::CUSTOM_LOGO_PATH, fopen($_FILES['Filedata']['tmp_name'], 'rb'));
 
         // set content-type to text/html, otherwise (when application/json is sent) chrome will complain in
         // Ext.form.Action.Submit and mark the submission as failed

Fixed code:         if($fileExt === 'svg') {
            if(strpos(file_get_contents($_FILES['Filedata']['tmp_name']), '<script')) {
                throw new \Exception('Scripts in SVG files are not supported');
            }
        }
CVE-2022-0348: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-01-27T14:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php
Commit date: 2022-01-27 12:29:56 +0100
Commit message: added escape function to the icon field

Diff: diff --git a/bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php b/bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php
index 84582a8c58f..93339ef2069 100644
--- a/bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php
+++ b/bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php
@@ -117,11 +117,11 @@ class ClassController extends AdminController implements KernelControllerEventIn
 
             return [
                 'id' => $class->getId(),
                 'text' => $text,
                 'leaf' => true,
-                'icon' => $class->getIcon() ? $class->getIcon() : $defaultIcon,
+                'icon' => $class->getIcon() ? htmlspecialchars($class->getIcon()) : $defaultIcon,
                 'cls' => 'pimcore_class_icon',
                 'propertyVisibility' => $class->getPropertyVisibility(),
                 'enableGridLocking' => $class->isEnableGridLocking(),
             ];
         };

Vulnerable code:                 'icon' => $class->getIcon() ? $class->getIcon() : $defaultIcon,
Fixed code:                 'icon' => $class->getIcon() ? htmlspecialchars($class->getIcon()) : $defaultIcon,
CVE-2022-0510: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in Packagist pimcore/pimcore prior to 10.3.1.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-02-08T15:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php
Commit date: 2022-02-07 15:23:39 +0100
Commit message: [Admin] DataObject - Escape class definitions group properly

Diff: diff --git a/bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php b/bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php
index ac818bca6289..a041274b7b3f 100644
--- a/bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php
+++ b/bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php
@@ -859,11 +859,11 @@ class ClassController extends AdminController implements KernelControllerEventIn
 
             if ($item->getGroup()) {
                 if (!isset($groups[$item->getGroup()])) {
                     $groups[$item->getGroup()] = [
                         'id' => 'group_' . $item->getKey(),
-                        'text' => $item->getGroup(),
+                        'text' => htmlspecialchars($item->getGroup()),
                         'expandable' => true,
                         'leaf' => false,
                         'allowChildren' => true,
                         'iconCls' => 'pimcore_icon_folder',
                         'group' => $item->getGroup(),
@@ -1264,11 +1264,11 @@ class ClassController extends AdminController implements KernelControllerEventIn
 
             if ($item->getGroup()) {
                 if (!isset($groups[$item->getGroup()])) {
                     $groups[$item->getGroup()] = [
                         'id' => 'group_' . $item->getKey(),
-                        'text' => $item->getGroup(),
+                        'text' => htmlspecialchars($item->getGroup()),
                         'expandable' => true,
                         'leaf' => false,
                         'allowChildren' => true,
                         'iconCls' => 'pimcore_icon_folder',
                         'group' => $item->getGroup(),

Vulnerable code:                         'text' => $item->getGroup(),
                        'text' => $item->getGroup(),
Fixed code:                         'text' => htmlspecialchars($item->getGroup()),
                        'text' => htmlspecialchars($item->getGroup()),
CVE-2022-0665: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Path Traversal in GitHub repository pimcore/pimcore prior to 10.3.2.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 6.5
Published: 2022-02-22T15:15Z
Repository: https://github.com/pimcore/pimcore
Language: Unknown
Commit date: 2022-02-21 16:51:01 +0100
Commit message: [Admin] Translations - use session for file import to prevent path traversal - Merge PR #11498
CVE-2022-0831: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-03-04T14:15Z
Repository: https://github.com/pimcore/pimcore
Language: JavaScript
Files changed: bundles/AdminBundle/Resources/public/js/pimcore/element/properties.js
Commit date: 2022-03-04 08:50:07 +0100
Commit message: escaping 'key' custom property field in elements
Diff: diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/element/properties.js b/bundles/AdminBundle/Resources/public/js/pimcore/element/properties.js
index 16466f0a5adb..0517e3163eef 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/element/properties.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/element/properties.js
@@ -566,14 +566,15 @@ pimcore.element.properties = Class.create({
         }
     },
 
     addSetFromUserDefined: function (customKey, customType) {
         try {
-            if (in_array(customKey.getValue(), this.disallowedKeys)) {
+            let key = htmlspecialchars(customKey.getValue());
+            if (in_array(key, this.disallowedKeys)) {
                 Ext.MessageBox.alert(t("error"), t("name_is_not_allowed"));
             }
-            this.add(customKey.getValue(), customType.getValue(), false, false, false, true);
+            this.add(key, customType.getValue(), false, false, false, true);
         } catch (e) {
             console.log(e);
         }
     },
 

Vulnerable code:             if (in_array(customKey.getValue(), this.disallowedKeys)) {
            this.add(customKey.getValue(), customType.getValue(), false, false, false, true);
Fixed code:             let key = htmlspecialchars(customKey.getValue());
            if (in_array(key, this.disallowedKeys)) {
            this.add(key, customType.getValue(), false, false, false, true);
CVE-2022-0832: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-03-04T14:15Z
Repository: https://github.com/pimcore/pimcore
Language: JavaScript
Files changed: bundles/AdminBundle/Resources/public/js/pimcore/document/pages/settings.js
Commit date: 2022-03-04 10:45:45 +0100
Commit message: escaping fields in SERP preview
Diff: diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/document/pages/settings.js b/bundles/AdminBundle/Resources/public/js/pimcore/document/pages/settings.js
index f14c6d285131..3737778b115b 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/document/pages/settings.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/document/pages/settings.js
@@ -77,12 +77,12 @@ pimcore.document.pages.settings = Class.create(pimcore.document.settings_abstrac
 
 
             var updateSerpPreview = function () {
 
                 var metaPanel = this.layout.getComponent("metaDataPanel");
-                var title = metaPanel.getComponent("title").getValue();
-                var description = metaPanel.getComponent("description").getValue();
+                var title = htmlspecialchars(metaPanel.getComponent("title").getValue());
+                var description = htmlspecialchars(metaPanel.getComponent("description").getValue());
 
                 var truncate = function( text, n ){
                     if (text.length <= n) { return text; }
                     var subString = text.substr(0, n-1);
                     return subString.substr(0, subString.lastIndexOf(' ')) + " ...";

Vulnerable code:                 var title = metaPanel.getComponent("title").getValue();
                var description = metaPanel.getComponent("description").getValue();
Fixed code:                 var title = htmlspecialchars(metaPanel.getComponent("title").getValue());
                var description = htmlspecialchars(metaPanel.getComponent("description").getValue());
CVE-2022-1219: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection in RecyclebinController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 7.5
Published: 2022-04-08T09:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: bundles/AdminBundle/Controller/Admin/RecyclebinController.php
Commit date: 2022-04-07 10:57:16 +0200
Commit message: [Recyclebin] Quote condition filter

Diff: diff --git a/bundles/AdminBundle/Controller/Admin/RecyclebinController.php b/bundles/AdminBundle/Controller/Admin/RecyclebinController.php
index 550a34bdc49d..d5d273aefb93 100644
--- a/bundles/AdminBundle/Controller/Admin/RecyclebinController.php
+++ b/bundles/AdminBundle/Controller/Admin/RecyclebinController.php
@@ -117,11 +117,11 @@ class RecyclebinController extends AdminController implements KernelControllerEv
                     if ($filter['type'] == 'date' && $operator == '=') {
                         $maxTime = $value + (86400 - 1); //specifies the top point of the range used in the condition
                         $condition = $field . ' BETWEEN ' . $db->quote($value) . ' AND ' . $db->quote($maxTime);
                         $conditionFilters[] = $condition;
                     } else {
-                        $conditionFilters[] = $field . $operator . " '" . $value . "' ";
+                        $conditionFilters[] = $field . $operator . ' ' . $db->quote($value);
                     }
                 }
             }
 
             if (!empty($conditionFilters)) {

Vulnerable code:                         $conditionFilters[] = $field . $operator . " '" . $value . "' ";
Fixed code:                         $conditionFilters[] = $field . $operator . ' ' . $db->quote($value);
CVE-2023-0323: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.14.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-01-16T15:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: models/DataObject/ClassDefinition/Service.php
Commit date: 2023-01-02 15:26:25 +0100
Commit message: Fix: X-site-scripting (#13916)


Diff: diff --git a/models/DataObject/ClassDefinition/Service.php b/models/DataObject/ClassDefinition/Service.php
index 9b6f6918aaeb..681261841166 100644
--- a/models/DataObject/ClassDefinition/Service.php
+++ b/models/DataObject/ClassDefinition/Service.php
@@ -339,10 +339,15 @@ class Service
      * @throws \Exception
      */
     public static function generateLayoutTreeFromArray($array, $throwException = false, $insideLocalizedField = false)
     {
         if (is_array($array) && count($array) > 0) {
+            if ($title = $array['title'] ?? false) {
+                if (preg_match('/<.+?>/', $title)) {
+                    throw new \Exception('not a valid title:' . htmlentities($title));
+                }
+            }
             if ($name = $array['name'] ?? false) {
                 if (preg_match('/<.+?>/', $name)) {
                     throw new \Exception('not a valid name:' . htmlentities($name));
                 }
             }

Fixed code:             if ($title = $array['title'] ?? false) {
                if (preg_match('/<.+?>/', $title)) {
                    throw new \Exception('not a valid title:' . htmlentities($title));
                }
            }
CVE-2023-1115: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-01T14:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: models/Document/Editable/Link.php
Commit date: 2023-03-01 13:42:13 +0100
Commit message: [Task] Optimizing dialog (#14500)

* Optimizing dialog

* Modify optimization
Diff: diff --git a/models/Document/Editable/Link.php b/models/Document/Editable/Link.php
index 4d629fa55ede..f471e4faf4ff 100644
--- a/models/Document/Editable/Link.php
+++ b/models/Document/Editable/Link.php
@@ -297,10 +297,15 @@ class Link extends Model\Document\Editable implements IdRewriterInterface, Editm
                     }
                 }
             }
         }
 
+        // sanitize attributes
+        if(isset($this->data['attributes']))  {
+            $this->data['attributes'] = htmlspecialchars($this->data['attributes'], HTML_ENTITIES);
+        }
+
         // deletes unnecessary attribute, which was set by mistake in earlier versions, see also
         // https://github.com/pimcore/pimcore/issues/7394
         if (isset($this->data['type'])) {
             unset($this->data['type']);
         }

Fixed code:         // sanitize attributes
        if(isset($this->data['attributes']))  {
            $this->data['attributes'] = htmlspecialchars($this->data['attributes'], HTML_ENTITIES);
        }
CVE-2023-1117: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-01T14:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: bundles/AdminBundle/Controller/Admin/SettingsController.php, bundles/AdminBundle/Resources/public/js/pimcore/settings/videothumbnail/item.js
Commit date: 2023-02-27 16:29:25 +0100
Commit message: optimized video thumbnail creation (#14472)


Diff: diff --git a/bundles/AdminBundle/Controller/Admin/SettingsController.php b/bundles/AdminBundle/Controller/Admin/SettingsController.php
index ac7a97b1acdd..58508f403af1 100644
--- a/bundles/AdminBundle/Controller/Admin/SettingsController.php
+++ b/bundles/AdminBundle/Controller/Admin/SettingsController.php
@@ -1552,11 +1552,11 @@ class SettingsController extends AdminController
         foreach ($mediaData as $mediaName => $items) {
             foreach ($items as $item) {
                 $type = $item['type'];
                 unset($item['type']);
 
-                $pipe->addItem($type, $item, $mediaName);
+                $pipe->addItem($type, $item, htmlspecialchars($mediaName));
             }
         }
 
         $pipe->save();
 
diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/settings/videothumbnail/item.js b/bundles/AdminBundle/Resources/public/js/pimcore/settings/videothumbnail/item.js
index e2f7c555f4d5..a174b7da9c1b 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/settings/videothumbnail/item.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/settings/videothumbnail/item.js
@@ -175,10 +175,11 @@ pimcore.settings.videothumbnail.item = Class.create({
 
         pimcore.layout.refresh();
     },
 
     addMediaPanel: function (name, items, closable, activate) {
+        name = name.replace(/[^a-zA-Z0-9_\-+]/g,'');
 
         if (this.medias[name]) {
             return;
         }
 

Vulnerable code:                 $pipe->addItem($type, $item, $mediaName);
Fixed code:                 $pipe->addItem($type, $item, htmlspecialchars($mediaName));
        name = name.replace(/[^a-zA-Z0-9_\-+]/g,'');
CVE-2023-1286: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-03-09T11:15Z
Repository: https://github.com/pimcore/pimcore
Language: JavaScript
Files changed: bundles/AdminBundle/Resources/public/js/pimcore/document/printpages/pdf_preview.js
Commit date: 2023-03-09 10:21:39 +0100
Commit message: [Task] Improve webtoprint pdf (#14560)

* Improve webtoprint pdf

* Use different method
Diff: diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/document/printpages/pdf_preview.js b/bundles/AdminBundle/Resources/public/js/pimcore/document/printpages/pdf_preview.js
index e1c64a03ae79..00f522fa3a7e 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/document/printpages/pdf_preview.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/document/printpages/pdf_preview.js
@@ -262,19 +262,19 @@ pimcore.document.printpages.pdfpreview = Class.create({
 
     getCellRenderer: function (value, metaData, record, rowIndex, colIndex, store) {
         var data = record.data;
         var type = data.type;
 
-        if (type == "bool") {
-            if (value) {
-                return '<div style="text-align: left"><div role="button" class="x-grid-checkcolumn x-grid-checkcolumn-checked" style=""></div></div>';
-            } else {
-                return '<div style="text-align: left"><div role="button" class="x-grid-checkcolumn" style=""></div></div>';
-            }
+        if (type === "text") {
+            return Ext.util.Format.htmlEncode(value);
+        }
+
+        if (type === "bool") {
+            return '<div style="text-align: left"><div role="button" class="x-grid-checkcolumn' + (value ? ' x-grid-checkcolumn-checked' : '') + '" style=""></div></div>';
         }
 
-        if (type == "select") {
+        if (type === "select") {
             return t("web2print_" + value, value);
         }
 
         return value;
     },

Vulnerable code:         if (type == "bool") {
            if (value) {
                return '<div style="text-align: left"><div role="button" class="x-grid-checkcolumn x-grid-checkcolumn-checked" style=""></div></div>';
            } else {
                return '<div style="text-align: left"><div role="button" class="x-grid-checkcolumn" style=""></div></div>';
            }
        if (type == "select") {
Fixed code:         if (type === "text") {
            return Ext.util.Format.htmlEncode(value);
        }

        if (type === "bool") {
            return '<div style="text-align: left"><div role="button" class="x-grid-checkcolumn' + (value ? ' x-grid-checkcolumn-checked' : '') + '" style=""></div></div>';
        if (type === "select") {
CVE-2023-1312: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-03-10T11:15Z
Repository: https://github.com/pimcore/pimcore
Language: JavaScript
Files changed: bundles/AdminBundle/Resources/public/js/pimcore/log/admin.js
Commit date: 2023-03-10 10:07:04 +0100
Commit message: [ApplicationLogger] Improve Date & Time fields error tooltips (#14606)


Diff: diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/log/admin.js b/bundles/AdminBundle/Resources/public/js/pimcore/log/admin.js
index 25212ef17a80..17cba30e3c4b 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/log/admin.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/log/admin.js
@@ -259,28 +259,32 @@ pimcore.log.admin = Class.create({
             });
 
             this.fromDate = new Ext.form.DateField({
                 name: 'from_date',
                 width: 130,
+                invalidText: 'Enter date as MM/DD/YYYY',
                 xtype: 'datefield'
             });
 
             this.fromTime = new Ext.form.TimeField({
                 name: 'from_time',
                 width: 100,
+                invalidText: 'Enter time as HH:MM AM/PM',
                 xtype: 'timefield'
             });
 
             this.toDate = new Ext.form.DateField({
                 name: 'to_date',
                 width: 130,
+                invalidText: 'Enter date as MM/DD/YYYY',
                 xtype: 'datefield'
             });
 
             this.toTime = new Ext.form.TimeField({
                 name: 'to_time',
                 width: 100,
+                invalidText: 'Enter time as HH:MM AM/PM',
                 xtype: 'timefield'
             });
 
             this.searchpanel = new Ext.FormPanel({
                 region: "east",

Fixed code:                 invalidText: 'Enter date as MM/DD/YYYY',
                invalidText: 'Enter time as HH:MM AM/PM',
                invalidText: 'Enter date as MM/DD/YYYY',
                invalidText: 'Enter time as HH:MM AM/PM',
CVE-2023-1429: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-16T12:15Z
Repository: https://github.com/pimcore/pimcore
Language: JavaScript
Files changed: bundles/AdminBundle/Resources/public/js/pimcore/settings/docTypes.js
Commit date: 2023-03-14 13:37:09 +0100
Commit message: improve Document Types.

Diff: diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/settings/docTypes.js b/bundles/AdminBundle/Resources/public/js/pimcore/settings/docTypes.js
index b57353f933e4..19c8d96b68c3 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/settings/docTypes.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/settings/docTypes.js
@@ -226,12 +226,14 @@ pimcore.settings.document.doctypes = Class.create({
                         return klass;
                     },
                     tooltip: t('delete'),
                     handler: function (grid, rowIndex) {
                         let data = grid.getStore().getAt(rowIndex);
-                        pimcore.helpers.deleteConfirm(t('document_type'), data.data.name, function () {
-                            grid.getStore().removeAt(rowIndex);
+                        pimcore.helpers.deleteConfirm(t('document_type'),
+                            Ext.util.Format.htmlEncode(data.data.name),
+                            function () {
+                                grid.getStore().removeAt(rowIndex);
                         }.bind(this));
                     }.bind(this)
                 }]
             }, {
                 xtype: 'actioncolumn',

Vulnerable code:                         pimcore.helpers.deleteConfirm(t('document_type'), data.data.name, function () {
                            grid.getStore().removeAt(rowIndex);
Fixed code:                         pimcore.helpers.deleteConfirm(t('document_type'),
                            Ext.util.Format.htmlEncode(data.data.name),
                            function () {
                                grid.getStore().removeAt(rowIndex);