[CRITICAL] Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)

PKSA-kkjc-bw16-f3kq CVE-2026-55220 GHSA-w23p-wrp7-ch38

Affected package: pimcore/pimcore

Affected version: <=12.3.9|>=2026.1.0,<=2026.1.5

Reported by:
GitHub