CVE-2026-55634: Pimcore DataObject class-definition field name remote code execution

CVE-2026-55634 · Severity: critical · CVSS 9.9 · Published 2026-08-28

Pimcore is a digital experience platform used to manage product data and content. The platform auto-generates PHP class files based on administrator-defined field definitions; a content editor with standard "objects" permission can inject arbitrary PHP code into a field name, which gets embedded into the generated class and executes when any object of that class is loaded, leading to complete server compromise with full access to databases and file systems.

Technologies: pimcore/pimcore (Packagist), Pimcore. Vendors: Packagist, Pimcore.

Quick answers

Is CVE-2026-55634 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55634 being exploited in the wild.
How severe is CVE-2026-55634?
Critical severity, with a CVSS score of 9.9, published 28 August 2026.
Which products and versions are affected?
pimcore/pimcore (Packagist) ECOSYSTEM:introduced=0,fixed=12.3.10; Pimcore <= 12.3.9 or (>= 2026.1.0 and <= 2026.1.5).
Is there a fix for CVE-2026-55634?
Yes. pimcore/pimcore (Packagist): upgrade to 12.3.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55634 attacked?
It is attacked over the network.
Am I affected by CVE-2026-55634?
Check whether you run pimcore/pimcore (Packagist) or Pimcore at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • pimcore/pimcore (Packagist): upgrade to 12.3.10 or later
    composer require pimcore/pimcore:^12.3.10

Technical details

The vulnerability is a code-generation injection in Pimcore's DataObject class builder. The `FieldDefinitionPropertiesBuilder.php` concatenates user-supplied field names directly into PHP source (`protected $<fieldName>;`) without an identifier allowlist. An attacker field name like `pwn; public function __construct(){system($_GET['cmd']);} private $z` produces valid PHP that executes when the class is instantiated via `DataObject::getById()` or similar. The same field name is also concatenated (with weak backtick quoting) into ALTER TABLE DDL statements, enabling SQL injection. The attack is reachable via the `/class/definition/configuration-view/detail/{id}/import` POST endpoint, which requires only the standard "objects" permission (not admin), and performs no field-name validation. The RCE sink has been confirmed in an isolated harness using the unmodified builder source; the end-to-end exploit chain (import path preservation → DDL execution → object instantiation → constructor invocation) is reasoned from source code. This is a sibling of CVE-2026-5394 (composite-index SQL injection), whose fix hardened only the `compositeIndices` sink and missed the field-name path.

Affected products

  • Pimcore Pimcore <= 12.3.9 or (>= 2026.1.0 and <= 2026.1.5)

Identifiers

  • CVE-2026-55634
  • GHSA-9x44-4gxf-8c25

Timeline

  • 2026-05-29: disclosed: Vulnerability discovered during sibling sweep of CVE-2026-5394
  • 2026-07-30: advisory: GitHub Security Advisory published
  • 2026-08-28: patched: Fixed in Pimcore 12.3.10 and 2026.1.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.