Executive brief
Pimcore, an open-source data management platform, is vulnerable to a security flaw that allows administrative users to execute unauthorized database commands. By uploading a specially crafted configuration file during the data object import process, an attacker can modify the underlying database structure, delete data, or cause a system outage. This could lead to significant data loss or a complete disruption of the platform's operations.
Technical details
A SQL injection vulnerability exists in Pimcore's DataObject composite index handling. The root cause is the lack of sanitization and identifier quoting in `Pimcore\Model\DataObject\Traits\CompositeIndexTrait::updateCompositeIndices()`. Specifically, the `index_columns` and `index_key` values from imported JSON are concatenated directly into `ALTER TABLE` statements. An authenticated attacker with administrative privileges can use a malicious JSON payload to inject additional DDL clauses (e.g., `DROP COLUMN`) into the `ADD INDEX` command. This vulnerability does not require stacked queries as the injection occurs within a single `ALTER TABLE` statement. The issue is fixed in version 12.3.7.
Affected products
- Pimcore Pimcore Platform <= 12.3.6
Timeline
- 2026-05-26: advisory: GitHub Advisory published
- 2026-05-28: disclosed: Public disclosure date
- 12.3.7: patched: Vulnerability addressed in version 12.3.7
References
- https://api.github.com/users/researchatfluidattacks
- https://github.com/researchatfluidattacks
- https://api.github.com/users/researchatfluidattacks/gists%7B/gist_id%7D
- https://api.github.com/users/researchatfluidattacks/repos
- https://avatars.githubusercontent.com/u/252032344?v=4
- https://api.github.com/users/researchatfluidattacks/events%7B/privacy%7D