SQL Injection Vulnerability in Pimcore Open Source Data Management Platform
CVE-2026-55072

8.5HIGH

Key Information:

Vendor

Pimcore
Status
Pimcore
Vendor
CVE Published:
14 September 2026

What is CVE-2026-55072?

An SQL injection vulnerability exists in the Pimcore Open Source Data & Experience Management Platform, where an authenticated user possessing object permissions can manipulate the ClassDefinition UID. The flaw arises due to inadequate validation of names and IDs in the ClassDefinition.php file, which only checks the start of the values. When data objects containing a Block field are loaded, the Block::load function improperly incorporates the supplied class ID into an unquoted table identifier. This vulnerability enables an attacker to execute arbitrary SQL queries against the Pimcore database, potentially leading to unauthorized access to sensitive information such as password hashes. The issue has been rectified in version 2026.1.5, enforcing stricter validation protocols.

Affected Version(s)

pimcore < 2026.1.5

References

https://github.com/pimcore/pimcore/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/pimcore/pimcore/pull/19177
x_refsource_MISC
https://github.com/pimcore/pimcore/commit/33a0e1887e1e31b...
x_refsource_MISC

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.