# CVE-2026-55072: Pimcore ClassDefinition UID regex SQL injection in Block.php

Source: https://junglewise.ai/threats/cve-2026-55072-pimcore-classdefinition-uid-regex-sql-injection-in-block-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-55072 · Severity: high · CVSS 8.5 · Published 2026-09-14

Pimcore is a data management platform used to organize and manage digital assets and data objects. A flaw in input validation allows an authenticated editor (with standard "objects" permission) to inject SQL code when creating a class definition, which executes when any data object of that class is later loaded. An attacker can exfiltrate sensitive database tables including user credentials and password hashes without admin privileges.

Technologies: [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore), [Pimcore](https://junglewise.ai/threats/technologies/pimcore). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Pimcore](https://junglewise.ai/threats/vendors/pimcore).

## Quick answers

**Is CVE-2026-55072 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55072 being exploited in the wild.

**How severe is CVE-2026-55072?** High severity, with a CVSS score of 8.5, published 14 September 2026.

**Which products and versions are affected?** pimcore/pimcore (Packagist) ECOSYSTEM:introduced=2026.1.0,fixed=2026.1.5; Pimcore >=2026.1.0, <=2026.1.4 and <12.3.9.

**Is there a fix for CVE-2026-55072?** Yes. pimcore/pimcore (Packagist): upgrade to 2026.1.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55072 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55072?** Check whether you run pimcore/pimcore (Packagist) or Pimcore at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pimcore/pimcore (Packagist): upgrade to 2026.1.5 or later

  ```sh
  composer require pimcore/pimcore:^2026.1.5
  ```


## Technical details

The vulnerability combines two flaws: (1) an incomplete input validation regex in ClassDefinition.php lines 1148-1154 that lacks trailing anchors ($), allowing identifiers like "1 UNION SELECT password FROM users-- " to pass validation because preg_match only confirms the string *starts* with a valid pattern; (2) unquoted table name concatenation in Block.php lines 735, 744, 746, 748, 759, and 771 where getClassId() is directly embedded into SQL queries without quoting. An authenticated user with "objects" permission can create a malicious class definition with SQL-injection payload in the UID, then trigger its execution by loading a data object of that class. The payload executes via UNION-based SQL injection, allowing extraction of arbitrary database tables including the users table with password hashes. Patches are available in versions 2026.1.5 and 12.3.9 which add trailing regex anchors and quote table names via quoteIdentifier().

## Affected products

- Pimcore Pimcore >=2026.1.0, <=2026.1.4 and <12.3.9

## Identifiers

- CVE-2026-55072
- GHSA-2mhj-fhvg-v428

## Timeline

- 2026-08-13: disclosed: Public disclosure via GitHub Advisory Database
- 2026-08-13: patched: Patched in versions 2026.1.5 and 12.3.9

## References

- [https://api.github.com/users/dhairya7760](https://api.github.com/users/dhairya7760)
- [https://github.com/dhairya7760](https://github.com/dhairya7760)
- [https://api.github.com/users/dhairya7760/gists%7B/gist_id%7D](https://api.github.com/users/dhairya7760/gists%7B/gist_id%7D)
- [https://api.github.com/users/dhairya7760/repos](https://api.github.com/users/dhairya7760/repos)
- [https://avatars.githubusercontent.com/u/56912333?v=4](https://avatars.githubusercontent.com/u/56912333?v=4)
- [https://api.github.com/users/dhairya7760/events%7B/privacy%7D](https://api.github.com/users/dhairya7760/events%7B/privacy%7D)

## Related threats

- [Pimcore stored cross-site scripting in data objects](https://junglewise.ai/threats/cve-2026-109392-pimcore-through-2026-3-1-contains-a-stored-cross-site-scripting)
- [Pimcore SQL injection in Custom Reports via configuration](https://junglewise.ai/threats/cve-2026-55416-pimcore-sql-injection-in-custom-reports-via-configuration)
- [Pimcore DataObject class-definition field name remote code execution](https://junglewise.ai/threats/cve-2026-55634-pimcore-dataobject-class-definition-field-name-remote-code)
- [Pimcore Hotspotimage unrestricted PHP object deserialization](https://junglewise.ai/threats/cve-2026-55220-pimcore-hotspotimage-unrestricted-php-object-deserialization)
- [Pimcore CustomReports authorization bypass in report detail endpoint](https://junglewise.ai/threats/cve-2026-45704-pimcore-customreports-authorization-bypass-in-report-detail)