Read the docs
TI-2026-39777 Aliases CVE-2026-55072GHSA-2mhj-fhvg-v428

Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

Priority HIGH 70CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the beginning of each value. When a data object of that class containing a Block field is loaded, Block::load in models/DataObject/ClassDefinition/Data/Block.php incorporates the stored class ID into an unquoted object table identifier, allowing the UID to supply SQL syntax. The resulting query can read or modify arbitrary Pimcore database tables, including disclosure of password hashes, and the flaw represents an incomplete validation hardening because earlier work added a start anchor without enforcing the end of the identifier. This issue is fixed in version 2026.1.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00409 35th percentileScored 2026-11-07
Fix Fixed pimcore (pimcore): 2026.1.5pimcore/pimcore (Packagist): 2026.1.5, 12.3.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pimcorepimcorebefore 2026.1.52026.1.5Patch availableCNA
—pimcore/pimcore (Packagist)2026.1.0 to before 2026.1.52026.1.5Patch availableGHSA-2mhj-fhvg-v428
—pimcore/pimcore (Packagist)before 12.3.912.3.9Patch availableGHSA-2mhj-fhvg-v428
  • pimcore Vendorpimcore Affected before 2026.1.5 Fixed in 2026.1.5 Patch available CNA
  • pimcore/pimcore (Packagist) Vendor— Affected 2026.1.0 to before 2026.1.5 Fixed in 2026.1.5 Patch available GHSA-2mhj-fhvg-v428
  • pimcore/pimcore (Packagist) Vendor— Affected before 12.3.9 Fixed in 12.3.9 Patch available GHSA-2mhj-fhvg-v428

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*——pimcore
  • cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:* Versions — — ·pimcore

Remediation

  • Fix · CNA pimcore (pimcore) Fixed in 2026.1.5
  • Fix · GHSA-2mhj-fhvg-v428 pimcore/pimcore (Packagist) Fixed in 2026.1.5 Advisory →
  • Fix · GHSA-2mhj-fhvg-v428 pimcore/pimcore (Packagist) Fixed in 12.3.9 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55072
  2. 2026-10-03 Alias added: GHSA-2mhj-fhvg-v428

References

Other 5

  • TI-2026-18925 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848 CVSS 3.1HIGH 8.8
  • TI-2024-15667 Pimcore Admin Classic Bundle host header injection in the password reset CVSS 3.1HIGH 8.8
  • TI-2026-40161 Pimcore: Remote Code Execution via DataObject Class-Definition Field Name CVSS 3.1CRITICAL 9.9
  • TI-2026-18926 Pimcore ENV Variables and Cookie Informations are exposed in http_error_log CVSS 3.1HIGH 8.6
  • TI-2024-16853 Pimcore Host Header Injection in user invitation link CVSS 3.1CRITICAL 9.3
  • TI-2023-01489 SQL Injection in pimcore/pimcore CVSS 3.1HIGH 8.8
See all 171 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences