« Volver al listado

CVE-2026-41249

Estado: AplazadaAlta (8.2)—

CoreShop is a Pimcore enhanced eCommerce solution. In versions 5.0.1 through 5.1.0-beta.1,, the GitHub Actions workflow (`.github/workflows/static.yml`) uses the `pull_request_target` trigger but dangerously checks out the unverified code from the pull request head (`ref: ${{ github.event.pull_request.head.ref }}`). Subsequently, it executes a script (`bin/console`) from this untrusted checkout. This allows any external attacker to achieve Remote Code Execution (RCE) on the GitHub Actions runner simply by submitting a malicious Pull Request. Also known as a "Pwn Request" vulnerability. As of time of publication, `pull_request_target` is still in the file.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N/PR:N permite explotación remota sin autenticación (T1190). El atacante ejecuta código mediante un PR malicioso que dispara un workflow de GitHub, logrando RCE en el runner (T1059).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementVulnerability ScanningRestrict Web-Based ContentNetwork SegmentationLimit Software InstallationLimit Access to Resource Over Network

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Coreshop — CoreshopAIPimcore — PimcoreAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-41249",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-41249",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-08T19:14:42.867763Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "coreshop",
          "product": "CoreShop",
          "versions": [
            {
              "status": "affected",
              "version": ">= 5.0.1, <= 5.1.0-beta.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-04T20:16:57.797",
  "references": [
    {
      "url": "https://github.com/coreshop/CoreShop/blob/5.1.0-beta.1/.github/workflows/static.yml#L14",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/coreshop/CoreShop/commit/cc1e3f547228ec5ebfc1dc0472f9a3cc5f4137a4",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/coreshop/CoreShop/security/advisories/GHSA-q58j-g3f4-h26h",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/coreshop/CoreShop/security/advisories/GHSA-q58j-g3f4-h26h",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CoreShop is a Pimcore enhanced eCommerce solution. In versions 5.0.1 through 5.1.0-beta.1,, the GitHub Actions workflow (`.github/workflows/static.yml`) uses the `pull_request_target` trigger but dangerously checks out the unverified code from the pull request head (`ref: ${{ github.event.pull_request.head.ref }}`). Subsequently, it executes a script (`bin/console`) from this untrusted checkout. This allows any external attacker to achieve Remote Code Execution (RCE) on the GitHub Actions runner simply by submitting a malicious Pull Request. Also known as a \"Pwn Request\" vulnerability. As of time of publication, `pull_request_target` is still in the file."
    },
    {
      "lang": "es",
      "value": "CoreShop es una solución de comercio electrónico mejorada de Pimcore. En las versiones 5.0.1 hasta 5.1.0-beta.1, el flujo de trabajo de GitHub Actions (.github/workflows/static.yml) utiliza el disparador pull_request_target pero, de forma peligrosa, extrae el código no verificado de la cabecera de la solicitud de extracción (ref: ${{ github.event.pull_request.head.ref }}). Posteriormente, ejecuta un script (bin/console) desde esta extracción no confiable. Esto permite a cualquier atacante externo lograr Ejecución Remota de Código (RCE) en el ejecutor de GitHub Actions simplemente enviando una solicitud de extracción maliciosa. También conocida como vulnerabilidad 'Pwn Request'. En el momento de la publicación, pull_request_target todavía está en el archivo."
    }
  ],
  "lastModified": "2026-07-22T20:10:00.127",
  "sourceIdentifier": "security-advisories@github.com"
}