Read the docs
TI-2026-04721 Aliases CVE-2026-5394GHSA-r2f4-ff2p-xc64

Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling

Priority LOW 31CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger unintended SQL execution in the backend. This issue affects pimcore: 12.3.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00434 37th percentileScored 2026-11-07
Fix Fixed pimcore/pimcore (Packagist): 12.3.7, 11.5.17, 2026.1.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pimcorepimcore12.3.3—No fix listedCNA
—pimcore/pimcore (Packagist)12.0.0-RC1 to before 12.3.712.3.7Patch availableGHSA-r2f4-ff2p-xc64
—pimcore/pimcore (Packagist)before 11.5.1711.5.17Patch availableGHSA-r2f4-ff2p-xc64
—pimcore/pimcore (Packagist)2026.1.0 to before 2026.1.32026.1.3Patch availableGHSA-r2f4-ff2p-xc64
  • pimcore Vendorpimcore Affected 12.3.3 Fixed in — No fix listed CNA
  • pimcore/pimcore (Packagist) Vendor— Affected 12.0.0-RC1 to before 12.3.7 Fixed in 12.3.7 Patch available GHSA-r2f4-ff2p-xc64
  • pimcore/pimcore (Packagist) Vendor— Affected before 11.5.17 Fixed in 11.5.17 Patch available GHSA-r2f4-ff2p-xc64
  • pimcore/pimcore (Packagist) Vendor— Affected 2026.1.0 to before 2026.1.3 Fixed in 2026.1.3 Patch available GHSA-r2f4-ff2p-xc64

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*——pimcore
  • cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:* Versions — — ·pimcore

Remediation

  • Fix · GHSA-r2f4-ff2p-xc64 pimcore/pimcore (Packagist) Fixed in 12.3.7 Advisory →
  • Fix · GHSA-r2f4-ff2p-xc64 pimcore/pimcore (Packagist) Fixed in 11.5.17 Advisory →
  • Fix · GHSA-r2f4-ff2p-xc64 pimcore/pimcore (Packagist) Fixed in 2026.1.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-5394
  2. 2026-10-03 Alias added: GHSA-r2f4-ff2p-xc64

References

Patch 1

Advisory 2

Other 4

  • TI-2026-18925 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848 CVSS 3.1HIGH 8.8
  • TI-2024-15667 Pimcore Admin Classic Bundle host header injection in the password reset CVSS 3.1HIGH 8.8
  • TI-2026-40161 Pimcore: Remote Code Execution via DataObject Class-Definition Field Name CVSS 3.1CRITICAL 9.9
  • TI-2026-18926 Pimcore ENV Variables and Cookie Informations are exposed in http_error_log CVSS 3.1HIGH 8.6
  • TI-2024-16853 Pimcore Host Header Injection in user invitation link CVSS 3.1CRITICAL 9.3
  • TI-2023-01489 SQL Injection in pimcore/pimcore CVSS 3.1HIGH 8.8
See all 171 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences