SQL Injection Vulnerability in Pimcore's Admin User Interface
CVE-2026-72562

8.8HIGH

Key Information:

Vendor

Pimcore
Status
Pimcore Admin-ui-classic-bundle
Vendor
CVE Published:
11 August 2026

What is CVE-2026-72562?

An SQL injection vulnerability exists in Pimcore's admin-ui-classic-bundle, allowing authenticated backend users to run arbitrary SQL queries through the DataObject grid id column filter. This occurs due to improper handling of the filter value, which is directly concatenated into the SQL WHERE clause without using parameterization. An attacker with backend access could potentially exfiltrate or modify sensitive database information.

Affected Version(s)

pimcore admin-ui-classic-bundle 0 <= 2.3

References

https://github.com/pimcore/admin-ui-classic-bundle

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bobur Abdugafforov
.