Is CVE-2026-44741 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44741 being exploited in the wild.

How severe is CVE-2026-44741?

High severity, with a CVSS score of 8.8, published 27 May 2026.

Which products and versions are affected?

pimcore/admin-ui-classic-bundle (Packagist) <= 2.3.5, ECOSYSTEM:introduced=2.0.0-RC1,fixed=2.3.6; Pimcore Admin UI Classic Bundle <= 2.3.5.

Is there a fix for CVE-2026-44741?

Yes. pimcore/admin-ui-classic-bundle (Packagist): upgrade to 2.3.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44741 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44741?

Check whether you run pimcore/admin-ui-classic-bundle (Packagist) or Pimcore Admin UI Classic Bundle at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44741: Pimcore Admin Classic Bundle SQL injection in translation grid date filter

Q: Is there a fix for CVE-2026-44741?

Yes. pimcore/admin-ui-classic-bundle (Packagist): upgrade to 2.3.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44741 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44741?

Check whether you run pimcore/admin-ui-classic-bundle (Packagist) or Pimcore Admin UI Classic Bundle at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44741 · Severity: high · CVSS 8.8 · Published 2026-05-27

Pimcore Admin Classic Bundle is a management interface for the Pimcore data platform. A security vulnerability in the translation management component allows an authenticated user to perform unauthorized database queries. This could lead to the theft of sensitive information, such as user credentials, or potentially allow an attacker to take full control of the server when combined with other known issues.

Technologies: pimcore/admin-ui-classic-bundle (Packagist), Pimcore Admin UI Classic Bundle. Vendors: Packagist, Pimcore.

Quick answers

Is CVE-2026-44741 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44741 being exploited in the wild.
How severe is CVE-2026-44741?: High severity, with a CVSS score of 8.8, published 27 May 2026.
Which products and versions are affected?: pimcore/admin-ui-classic-bundle (Packagist) <= 2.3.5, ECOSYSTEM:introduced=2.0.0-RC1,fixed=2.3.6; Pimcore Admin UI Classic Bundle <= 2.3.5.
Is there a fix for CVE-2026-44741?: Yes. pimcore/admin-ui-classic-bundle (Packagist): upgrade to 2.3.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44741 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44741?: Check whether you run pimcore/admin-ui-classic-bundle (Packagist) or Pimcore Admin UI Classic Bundle at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pimcore/admin-ui-classic-bundle (Packagist): upgrade to 2.3.6 or later
```
composer require pimcore/admin-ui-classic-bundle:^2.3.6
```

Technical details

A SQL injection vulnerability exists in the `TranslationController.php` component of the Pimcore Admin Classic Bundle. The vulnerability occurs because the `property` field from user-supplied JSON filter parameters is directly interpolated into a SQL expression within the `UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...)))` function. While the application attempts to sanitize the input by removing '--' strings, this protection is easily bypassed using alternative SQL comment syntax. An authenticated attacker with permissions to view translations can exploit this via a POST request to `/admin/translation/translations` to perform UNION-based or error-based SQL injection. This can be further chained with other vulnerabilities (like unsafe deserialization) to achieve Remote Code Execution (RCE). The issue is fixed in version 2.3.6 by implementing an allowlist for valid column names and using identifier quoting.

Affected products

Pimcore admin-ui-classic-bundle <= 2.3.5

Identifiers

CVE-2026-44741
GHSA-h4ph-crvj-9h92

Timeline

2026-05-26: disclosed
2026-05-27: advisory
2026-05-27: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.