Executive brief
Pimcore is a data management platform used to organize and manage digital assets and data objects. A flaw in input validation allows an authenticated editor (with standard "objects" permission) to inject SQL code when creating a class definition, which executes when any data object of that class is later loaded. An attacker can exfiltrate sensitive database tables including user credentials and password hashes without admin privileges.
Technical details
The vulnerability combines two flaws: (1) an incomplete input validation regex in ClassDefinition.php lines 1148-1154 that lacks trailing anchors ($), allowing identifiers like "1 UNION SELECT password FROM users-- " to pass validation because preg_match only confirms the string *starts* with a valid pattern; (2) unquoted table name concatenation in Block.php lines 735, 744, 746, 748, 759, and 771 where getClassId() is directly embedded into SQL queries without quoting. An authenticated user with "objects" permission can create a malicious class definition with SQL-injection payload in the UID, then trigger its execution by loading a data object of that class. The payload executes via UNION-based SQL injection, allowing extraction of arbitrary database tables including the users table with password hashes. Patches are available in versions 2026.1.5 and 12.3.9 which add trailing regex anchors and quote table names via quoteIdentifier().
Affected products
- Pimcore Pimcore >=2026.1.0, <=2026.1.4 and <12.3.9
Timeline
- 2026-08-13: disclosed: Public disclosure via GitHub Advisory Database
- 2026-08-13: patched: Patched in versions 2026.1.5 and 12.3.9