SQL Injection Vulnerability in Pimcore's Admin Classic Bundle
CVE-2026-44741
8.8HIGH
What is CVE-2026-44741?
A SQL injection vulnerability exists in the Admin Classic Bundle of Pimcore, specifically in the translation grid date filter. The issue arises when the 'property' field from the user-supplied filter JSON is directly interpolated into the SQL expression 'UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...)))' without proper parameterization or allowlist validation. This could potentially allow attackers to execute arbitrary SQL queries, leading to unauthorized access or data manipulation. Users are advised to update to versions 2.3.6 or 1.7.18 or later to mitigate this security risk.
Affected Version(s)
pimcore < 1.7.18 < 1.7.18
pimcore >= 2.0.0-RC1, < 2.3.6 < 2.0.0-RC1, 2.3.6