CVE-2026-55072: Pimcore ClassDefinition UID regex SQL injection in Block.php

CVE-2026-55072 · Severity: high · CVSS 8.5 · Published 2026-09-14

Pimcore is a data management platform used to organize and manage digital assets and data objects. A flaw in input validation allows an authenticated editor (with standard "objects" permission) to inject SQL code when creating a class definition, which executes when any data object of that class is later loaded. An attacker can exfiltrate sensitive database tables including user credentials and password hashes without admin privileges.

Technologies: pimcore/pimcore (Packagist), Pimcore. Vendors: Packagist, Pimcore.

Quick answers

Is CVE-2026-55072 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55072 being exploited in the wild.
How severe is CVE-2026-55072?
High severity, with a CVSS score of 8.5, published 14 September 2026.
Which products and versions are affected?
pimcore/pimcore (Packagist) ECOSYSTEM:introduced=2026.1.0,fixed=2026.1.5; Pimcore >=2026.1.0, <=2026.1.4 and <12.3.9.
Is there a fix for CVE-2026-55072?
Yes. pimcore/pimcore (Packagist): upgrade to 2026.1.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55072 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-55072?
Check whether you run pimcore/pimcore (Packagist) or Pimcore at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • pimcore/pimcore (Packagist): upgrade to 2026.1.5 or later
    composer require pimcore/pimcore:^2026.1.5

Technical details

The vulnerability combines two flaws: (1) an incomplete input validation regex in ClassDefinition.php lines 1148-1154 that lacks trailing anchors ($), allowing identifiers like "1 UNION SELECT password FROM users-- " to pass validation because preg_match only confirms the string *starts* with a valid pattern; (2) unquoted table name concatenation in Block.php lines 735, 744, 746, 748, 759, and 771 where getClassId() is directly embedded into SQL queries without quoting. An authenticated user with "objects" permission can create a malicious class definition with SQL-injection payload in the UID, then trigger its execution by loading a data object of that class. The payload executes via UNION-based SQL injection, allowing extraction of arbitrary database tables including the users table with password hashes. Patches are available in versions 2026.1.5 and 12.3.9 which add trailing regex anchors and quote table names via quoteIdentifier().

Affected products

  • Pimcore Pimcore >=2026.1.0, <=2026.1.4 and <12.3.9

Identifiers

  • CVE-2026-55072
  • GHSA-2mhj-fhvg-v428

Timeline

  • 2026-08-13: disclosed: Public disclosure via GitHub Advisory Database
  • 2026-08-13: patched: Patched in versions 2026.1.5 and 12.3.9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.