CVE-2026-41249

{"id": "CVE-2026-41249", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41249", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-08T19:14:42.867763Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "coreshop", "product": "CoreShop", "versions": [{"status": "affected", "version": ">= 5.0.1, <= 5.1.0-beta.1"}]}]}], "published": "2026-06-04T20:16:57.797", "references": [{"url": "https://github.com/coreshop/CoreShop/blob/5.1.0-beta.1/.github/workflows/static.yml#L14", "source": "security-advisories@github.com"}, {"url": "https://github.com/coreshop/CoreShop/commit/cc1e3f547228ec5ebfc1dc0472f9a3cc5f4137a4", "source": "security-advisories@github.com"}, {"url": "https://github.com/coreshop/CoreShop/security/advisories/GHSA-q58j-g3f4-h26h", "source": "security-advisories@github.com"}, {"url": "https://github.com/coreshop/CoreShop/security/advisories/GHSA-q58j-g3f4-h26h", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "CoreShop is a Pimcore enhanced eCommerce solution. In versions 5.0.1 through 5.1.0-beta.1,, the GitHub Actions workflow (`.github/workflows/static.yml`) uses the `pull_request_target` trigger but dangerously checks out the unverified code from the pull request head (`ref: ${{ github.event.pull_request.head.ref }}`). Subsequently, it executes a script (`bin/console`) from this untrusted checkout. This allows any external attacker to achieve Remote Code Execution (RCE) on the GitHub Actions runner simply by submitting a malicious Pull Request. Also known as a \"Pwn Request\" vulnerability. As of time of publication, `pull_request_target` is still in the file."}, {"lang": "es", "value": "CoreShop es una soluci\u00f3n de comercio electr\u00f3nico mejorada de Pimcore. En las versiones 5.0.1 hasta 5.1.0-beta.1, el flujo de trabajo de GitHub Actions (.github/workflows/static.yml) utiliza el disparador pull_request_target pero, de forma peligrosa, extrae el c\u00f3digo no verificado de la cabecera de la solicitud de extracci\u00f3n (ref: ${{ github.event.pull_request.head.ref }}). Posteriormente, ejecuta un script (bin/console) desde esta extracci\u00f3n no confiable. Esto permite a cualquier atacante externo lograr Ejecuci\u00f3n Remota de C\u00f3digo (RCE) en el ejecutor de GitHub Actions simplemente enviando una solicitud de extracci\u00f3n maliciosa. Tambi\u00e9n conocida como vulnerabilidad 'Pwn Request'. En el momento de la publicaci\u00f3n, pull_request_target todav\u00eda est\u00e1 en el archivo."}], "lastModified": "2026-07-22T20:10:00.127", "sourceIdentifier": "security-advisories@github.com"}