Skip to content

Release history

Pimcore releases

Multi-channel experience and engagement management platform.

Back to tool Latest release

All releases

16 shown

Review required
v2026.1.4 Security relevant
Auth

Class definition security enhancement

Open
Review required
v12.3.8 Security relevant

Class definition security

Open
Review required
v2026.1.3 Security relevant
Auth RBAC

Permission check + unserializer hardening

Open
Review required
v12.3.7 Security relevant
Auth RBAC

Unserializer hardening + permission check

Open
v2026.1.2 Bug fix
Security fixes
  • Enhance SQL security in Custom Report
  • Enhance Custom Report controller actions
Full changelog

What's Changed

  • [Bug, EC] PEES-1067: Adjust log entry DateTime extraction by @jcPimcore in https://github.com/pimcore/pimcore/pull/19091
  • [Security]: Enhance SQL security in Custom Report by @kingjia90 in https://github.com/pimcore/pimcore/pull/19098
  • Fix Gotenberg document conversion failing for assets stored on S3 by @vrobert78 in https://github.com/pimcore/pimcore/pull/18899
  • [Security] Enhance Custom Report controller actions by @kingjia90 in https://github.com/pimcore/pimcore/pull/19099
  • Save generated object brick container class in PIMCORE_CLASS_DIRECTORY, not PIMCORE_CLASS_DEFINITION_DIRECTORY by @Jan-Walther-Basilicom in https://github.com/pimcore/pimcore/pull/18959
  • [Bug]: Add missing NO_AUTO_CACHE_CONTROL_HEADER for existing thumbnails by @vrobert78 in https://github.com/pimcore/pimcore/pull/19061
  • [Bug, EC] PEES-1103: Revert by @jcPimcore in https://github.com/pimcore/pimcore/pull/19104

New Contributors

  • @vrobert78 made their first contribution in https://github.com/pimcore/pimcore/pull/18899
  • @Jan-Walther-Basilicom made their first contribution in https://github.com/pimcore/pimcore/pull/18959

Full Changelog: https://github.com/pimcore/pimcore/compare/v2026.1.1...v2026.1.2

View release on GitHub
v12.3.6 Mixed
Security fixes
  • Enhanced SQL security for Custom Reports
  • Enhanced security for Custom Report controller actions
Notable features
  • SQL security enhancements in Custom Report functionality
  • Directory change: generated object brick container classes saved in PIMCORE_CLASS_DIRECTORY
Full changelog

What's Changed

  • [Security]: Enhance SQL security in Custom Report by @kingjia90 in https://github.com/pimcore/pimcore/pull/19098
  • Fix Gotenberg document conversion failing for assets stored on S3 by @vrobert78 in https://github.com/pimcore/pimcore/pull/18899
  • [Security] Enhance Custom Report controller actions by @kingjia90 in https://github.com/pimcore/pimcore/pull/19099
  • Save generated object brick container class in PIMCORE_CLASS_DIRECTORY, not PIMCORE_CLASS_DEFINITION_DIRECTORY by @Jan-Walther-Basilicom in https://github.com/pimcore/pimcore/pull/18959
  • [Bug, EC] PEES-1103: Revert by @jcPimcore in https://github.com/pimcore/pimcore/pull/19104

New Contributors

  • @Jan-Walther-Basilicom made their first contribution in https://github.com/pimcore/pimcore/pull/18959

Full Changelog: https://github.com/pimcore/pimcore/compare/v12.3.5...v12.3.6

View release on GitHub
v2026.1.1 Bug fix

Fixed quoting fields in the SQL adapter.

Full changelog

What's Changed

  • [Task] Refine upgrade notes for installer profile-based architecture by @mcop1 in https://github.com/pimcore/pimcore/pull/19072
  • [Bug] Load startup.php when booting the real kernel during installation by @mcop1 in https://github.com/pimcore/pimcore/pull/19077
  • [Task] Update PHPunit and Codeception by @jcPimcore in https://github.com/pimcore/pimcore/pull/19080
  • Chore/fix php cs fixer workflow by @berfinyuksel in https://github.com/pimcore/pimcore/pull/19087
  • Fix: quote fields in SQL adapter by @robertSt7 in https://github.com/pimcore/pimcore/pull/19089

Full Changelog: https://github.com/pimcore/pimcore/compare/v2026.1.0...v2026.1.1

View release on GitHub
v12.3.5 Bug fix

Fixed quoting of fields in the SQL adapter.

Full changelog

What's Changed

  • [Task] Update PHPunit and Codeception by @jcPimcore in https://github.com/pimcore/pimcore/pull/19080
  • Chore/fix php cs fixer workflow by @berfinyuksel in https://github.com/pimcore/pimcore/pull/19087
  • Fix: quote fields in SQL adapter by @robertSt7 in https://github.com/pimcore/pimcore/pull/19089

Full Changelog: https://github.com/pimcore/pimcore/compare/v12.3.4...v12.3.5

View release on GitHub
v2026.1.0 Breaking risk
⚠ Upgrade required
  • Update custom permission creation documentation in composer.json branch alias update
  • Remove deprecated bundles (Task: Remove deprecated bundles)
  • Adjust admin storage configuration in flysystem.yaml to follow pimcore_admin.translations.path changes
Breaking changes
  • Rename environment variable PIMCORE_MESSENGER_TRANSPORT_DSN to PIMCORE_MESSENGER_TRANSPORT_DSN_PREFIX
  • Remove doctrine enum mapping
Notable features
  • Update PHP and Symfony version requirements
  • Add argument trait and params to user role events
  • Introduce interfaces for video & document adapters and optimize metadata retrieval
Full changelog

What's Changed

  • Codeception for 11.x by @bluvulture in https://github.com/pimcore/pimcore/pull/18887
  • PHPStan for 11x by @bluvulture in https://github.com/pimcore/pimcore/pull/18897
  • [Task]: Update checkout steps for pull request handling by @kingjia90 in https://github.com/pimcore/pimcore/pull/18903
  • Force 11.5 for scheduled runs on 11.x static analysis by @bluvulture in https://github.com/pimcore/pimcore/pull/18906
  • Update doc to define how to create custom permission using the Defini… by @torqdev in https://github.com/pimcore/pimcore/pull/18895
  • [Task]: Remove '12.0' from workflow matrix references in Sync workflow by @kingjia90 in https://github.com/pimcore/pimcore/pull/18935
  • Update pull request template and checklist with correct target branch for bugfixes by @jdreesen in https://github.com/pimcore/pimcore/pull/18940
  • Feature: Update custom report docs with keyword filtering info by @torqdev in https://github.com/pimcore/pimcore/pull/18963
  • Update branch alias in composer.json by @herbertroth in https://github.com/pimcore/pimcore/pull/18990
  • [Task]: Adapt refs by @kingjia90 in https://github.com/pimcore/pimcore/pull/18993
  • Feature: Add arguments to the save version function. by @torqdev in https://github.com/pimcore/pimcore/pull/18425
  • Feature: Update PHP and Symfony version requirements by @herbertroth in https://github.com/pimcore/pimcore/pull/18994
  • Erweiterung der Fehlerignorierung in phpstan-lowest.neon für unbekann… by @herbertroth in https://github.com/pimcore/pimcore/pull/19019
  • Update symfony/webpack-encore-bundle version by @robertSt7 in https://github.com/pimcore/pimcore/pull/19023
  • Upstream merge: 12.3 → 12.x by @brusch in https://github.com/pimcore/pimcore/pull/18981
  • chore: replace @reusable-workflows with @main by @berfinyuksel in https://github.com/pimcore/pimcore/pull/19024
  • [Task]: Remove deprecated bundles by @kingjia90 in https://github.com/pimcore/pimcore/pull/19001
  • 🔄 synced file(s) with pimcore/sync-common-files by @pimcore-deployments in https://github.com/pimcore/pimcore/pull/19035
  • [Task]: Add admin storage configuration to flysystem.yaml and follow up pimcore_admin.translations.path by @kingjia90 in https://github.com/pimcore/pimcore/pull/19034
  • [Improvement] Redesign installer with profile-based architecture by @mcop1 in https://github.com/pimcore/pimcore/pull/19033
  • Add default value for PIMCORE_MESSENGER_TRANSPORT_DSN by @mcop1 in https://github.com/pimcore/pimcore/pull/19038
  • removed PO editor export workflow by @jcPimcore in https://github.com/pimcore/pimcore/pull/19040
  • [Improvement] Refactor messenger transport DSN to support multiple backends by @mcop1 in https://github.com/pimcore/pimcore/pull/19041
  • [Improvement] Rename PIMCORE_MESSENGER_TRANSPORT_DSN to PIMCORE_MESSENGER_TRANSPORT_DSN_PREFIX by @mcop1 in https://github.com/pimcore/pimcore/pull/19042
  • [Bug] Fix missing Doctrine mapping_types config in new installer by @mcop1 in https://github.com/pimcore/pimcore/pull/19043
  • [Improvement]: Remove conflicts for doctrine packages in composer.json by @kingjia90 in https://github.com/pimcore/pimcore/pull/18978
  • [Task]: Move reset password rate limiter to studio-backend by @robertSt7 in https://github.com/pimcore/pimcore/pull/18986
  • Remove doctrine enum mapping by @jcPimcore in https://github.com/pimcore/pimcore/pull/19044
  • [Improvement]: Remove space between QuantityValue value and unit by @dolmit-tanel-paaro in https://github.com/pimcore/pimcore/pull/18313
  • [Task]: Follow space removal between unit and abbreviation by @kingjia90 in https://github.com/pimcore/pimcore/pull/19045
  • Add system_appearance_settings to seed permissions and add defaults for error_pages config by @mcop1 in https://github.com/pimcore/pimcore/pull/19046
  • Feature: Add argument trait, and argument params to user role events. by @kingjia90 in https://github.com/pimcore/pimcore/pull/19051
  • [Improvement][GEE]: JobRunRepository additions by @kingjia90 in https://github.com/pimcore/pimcore/pull/18983
  • [Improvement]: Introduce interfaces for video & document adapters + optimize metadata retrieval by @Copilot in https://github.com/pimcore/pimcore/pull/19048
  • [TASK] Remove obsolete legacy EditmodeListener by @jcPimcore in https://github.com/pimcore/pimcore/pull/19055
  • [Improvement] Add install step filtering for PaaS environments by @mcop1 in https://github.com/pimcore/pimcore/pull/19054
  • [Task]: Add collation to tables in install.sql and Dao classes by @mcop1 in https://github.com/pimcore/pimcore/pull/19060
  • Add foreign key to unit fields to cleanup if unit is deleted by @matthiashamacher in https://github.com/pimcore/pimcore/pull/16836
  • Doc refactoring by @fashxp in https://github.com/pimcore/pimcore/pull/19037
  • [Task] Follow up Admin UI removal by @kingjia90 in https://github.com/pimcore/pimcore/pull/19036
  • Update PHP-CS-Fixer workflow by @berfinyuksel in https://github.com/pimcore/pimcore/pull/19052
  • [Task] Removed legacy extjs6 comment and code by @jcPimcore in https://github.com/pimcore/pimcore/pull/19056
  • [367] Composer updates by @jcPimcore in https://github.com/pimcore/pimcore/pull/19021

New Contributors

  • @jcPimcore made their first contribution in https://github.com/pimcore/pimcore/pull/19040

Full Changelog: https://github.com/pimcore/pimcore/compare/v12.3.4...v2026.1.0
https://github.com/pimcore/pimcore/issues?q=is%3Aclosed%20milestone%3A%222026.1.0%22

View release on GitHub
v12.3.4 Bug fix

Fixed a bug where the query fetched outdated document versions.

Full changelog

What's Changed

  • [Bug] Fixed query that fetches outdated versions by @MartaMarija in https://github.com/pimcore/pimcore/pull/18969
  • [Bug]: Pimcore Core requirements to Admin by @kingjia90 in https://github.com/pimcore/pimcore/pull/19010
  • [Task]: Add conflict for broken symfony/event-dispatcher version by @lukmzig in https://github.com/pimcore/pimcore/pull/19064
  • [Bug]: Implement null check for className in Document.php by @kingjia90 in https://github.com/pimcore/pimcore/pull/19015

New Contributors

  • @MartaMarija made their first contribution in https://github.com/pimcore/pimcore/pull/18969

Full Changelog: https://github.com/pimcore/pimcore/compare/v12.3.3...v12.3.4
https://github.com/pimcore/pimcore/issues?q=is%3Aclosed%20milestone%3A%2212.3.4%22

View release on GitHub
v12.3.3 Security relevant
Security fixes
  • Dependency Dao refactored to use parameter binding for all SQL queries — mitigates SQL‑injection risk
Full changelog

What's Changed

  • [Bug]: Gotenberg health ping instead of try convert dummy file by @kingjia90 in https://github.com/pimcore/pimcore/pull/18954
  • [Bug, EC] PEES-923: type error in getDataForListfolderGrid by @kingjia90 in https://github.com/pimcore/pimcore/pull/18977
  • [Security]: Dependency Dao - Refactor SQL queries to use parameter binding by @kingjia90 in https://github.com/pimcore/pimcore/pull/18991

Full Changelog: https://github.com/pimcore/pimcore/compare/v12.3.2...v12.3.3

View release on GitHub
v12.3.2 Bug fix

Fixed Command pimcore:deployment:classes-rebuild flags -c and -o now work together.

Full changelog

What's Changed

  • [Bug]: Fix Command pimcore:deployment:classes-rebuild flags -c and -o do not work together by @kingjia90 in https://github.com/pimcore/pimcore/pull/18930
  • [Docs]: Added Link to Limitations by @astapc in https://github.com/pimcore/pimcore/pull/18753
  • [Docs]: Added Link to Limitations in FC docs by @astapc in https://github.com/pimcore/pimcore/pull/18752
  • Improve PHPDoc in PasswordHasherFactory by @jdreesen in https://github.com/pimcore/pimcore/pull/18686
  • Remove empty line from static analysis workflow by @bluvulture in https://github.com/pimcore/pimcore/pull/18905
  • [Imagick] Ensure only the first image is getting loaded when re-initializing by @brusch in https://github.com/pimcore/pimcore/pull/18820
  • [Image gallery] Write inherited hotspot data to query table when saving parent by @BlackbitDevs in https://github.com/pimcore/pimcore/pull/18855
  • Fix hotspot data index by @robertSt7 in https://github.com/pimcore/pimcore/pull/18948

Full Changelog: https://github.com/pimcore/pimcore/compare/v12.3.1.1...v12.3.2

View release on GitHub
v12.3.1.1 Bug fix

Fixed inability to save localized field data within block fields and added a guard for missing tables during log cleanup.

Full changelog

What's Changed

  • [Bug, EC] PEES-887: Not able to save localized field data within block field in Pimcore V 2025.3 by @kingjia90 in https://github.com/pimcore/pimcore/pull/18919
  • fix: Skip http_error_log cleanup migration if table is missing by @astehlik in https://github.com/pimcore/pimcore/pull/18922

New Contributors

  • @astehlik made their first contribution in https://github.com/pimcore/pimcore/pull/18922

Full Changelog: https://github.com/pimcore/pimcore/compare/v12.3.1...v12.3.1.1

View release on GitHub
v11.5.14.1 Bug fix

Fixed crash when running the http_error_log cleanup migration on databases lacking the target table.

Full changelog

What's Changed

  • fix: Skip http_error_log cleanup migration if table is missing by @astehlik in https://github.com/pimcore/pimcore/pull/18922

New Contributors

  • @astehlik made their first contribution in https://github.com/pimcore/pimcore/pull/18922

Full Changelog: https://github.com/pimcore/pimcore/compare/v11.5.14...v11.5.14.1

View release on GitHub
v12.3.1 Security relevant
Security fixes
  • Brick key validity check during filtered search prevents unauthorized access (no CVE ID provided).
  • Remove and disable sensitive data log in http error Log eliminates exposure of confidential information.
Full changelog

What's Changed

  • [Bug,EC]: PEES-883 - Blurry images fix should be limited to vectorial types by @kingjia90 in https://github.com/pimcore/pimcore/pull/18886
  • [Bug, EC] PEES-881: Fix misleading Document Thumbnail Creation log message by @kingjia90 in https://github.com/pimcore/pimcore/pull/18894
  • [Bug]: Fix Static Route permission by @kingjia90 in https://github.com/pimcore/pimcore/pull/18893
  • [Bug, EC] PEES-888: Loss of all relation data in FC after moving DataObjects by @kingjia90 in https://github.com/pimcore/pimcore/pull/18892
  • Workflows update for 11.x by @bluvulture in https://github.com/pimcore/pimcore/pull/18904
  • [Security]: Brick key validity check during filtered search by @kingjia90 in https://github.com/pimcore/pimcore/pull/18913
  • [Task]: Fix stan by @kingjia90 in https://github.com/pimcore/pimcore/pull/18914
  • [Bug, EC] PEES-900: TypeError for Asset::getById() when using protected asset folder and controller action by @kingjia90 in https://github.com/pimcore/pimcore/pull/18915
  • [Bug, EC] PEES-894: Video Editable getThumbnail throws Type Error when e.g. type is missing by @kingjia90 in https://github.com/pimcore/pimcore/pull/18916
  • [Bug]: Default Value Generator not working when importing data by @kingjia90 in https://github.com/pimcore/pimcore/pull/18902
  • [Security]: Remove and disable sensitive data log in http error Log by @kingjia90 in https://github.com/pimcore/pimcore/pull/18918

Full Changelog: https://github.com/pimcore/pimcore/compare/v12.3.0...v12.3.1
https://github.com/pimcore/pimcore/issues?q=is%3Aclosed%20milestone%3A%2212.3.1%22

View release on GitHub
v11.5.14 Security relevant
Security fixes
  • Brick key validity check during filtered search (prevents unauthorized access)
  • Remove and disable sensitive data log in http error Log
Full changelog

What's Changed

  • [Bug,EC]: PEES-883 - Blurry images fix should be limited to vectorial types by @kingjia90 in https://github.com/pimcore/pimcore/pull/18886
  • [Bug]: Fix Static Route permission by @kingjia90 in https://github.com/pimcore/pimcore/pull/18893
  • [Bug, EC] PEES-888: Loss of all relation data in FC after moving DataObjects by @kingjia90 in https://github.com/pimcore/pimcore/pull/18892
  • Workflows update for 11.x by @bluvulture in https://github.com/pimcore/pimcore/pull/18904
  • [Security]: Brick key validity check during filtered search by @kingjia90 in https://github.com/pimcore/pimcore/pull/18913
  • [Security]: Remove and disable sensitive data log in http error Log by @kingjia90 in https://github.com/pimcore/pimcore/pull/18918

Full Changelog: https://github.com/pimcore/pimcore/compare/v11.5.13...v11.5.14
https://github.com/pimcore/pimcore/issues?q=is%3Aclosed%20milestone%3A%2211.5.14%22

View release on GitHub

Beta — feedback welcome: [email protected]