Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502) (CVE-2026-55220)

The vulnerability exists in Pimcore's `Hotspotimage::getDataFromResource()` method, which deserializes the `*__hotspots` object-store column using `Serialize::unserialize()` without a class allowlist, defaulting to unrestricted class instantiation. This allows an attacker who can write attacker-controlled serialized PHP objects into this column to achieve PHP Object Injection (CWE-502), leading to remote code execution via magic methods and gadget chains in bundled dependencies such as guzzlehttp/guzzle 7.11.0. The same pattern affects sibling marshallers `ImageGallery`, `Block`, and `Video`. The flaw is present in all maintained Pimcore versions including v2026.1.4 and v12.3.8. Exploitation requires the ability to write crafted serialized bytes into the relevant object-store column. A patch is available to restrict allowed classes during unserialization, mitigating the issue.

Successful exploitation allows an attacker with write access to the `*__hotspots` object-store column to execute arbitrary PHP code remotely by injecting serialized objects that instantiate arbitrary classes and trigger their magic methods. This can lead to remote code execution on the server running Pimcore, leveraging gadget chains in Pimcore's bundled dependencies. The vulnerability is critical due to the direct path from attacker-controlled serialized data to code execution without authentication or user interaction.

A patch is available that restricts the allowed classes during unserialization to prevent arbitrary object instantiation. Users should upgrade to a fixed Pimcore version that enforces a class allowlist in `Serialize::unserialize()`. Until patched, ensure that untrusted users cannot write to the `*__hotspots` object-store columns or related fields. Review and restrict database or storage write permissions to prevent injection of crafted serialized data. No generic mitigations override the need for patching.