Executive brief
Pimcore is a digital experience platform used to manage product data and content. The platform auto-generates PHP class files based on administrator-defined field definitions; a content editor with standard "objects" permission can inject arbitrary PHP code into a field name, which gets embedded into the generated class and executes when any object of that class is loaded, leading to complete server compromise with full access to databases and file systems.
Technical details
The vulnerability is a code-generation injection in Pimcore's DataObject class builder. The `FieldDefinitionPropertiesBuilder.php` concatenates user-supplied field names directly into PHP source (`protected
lt;fieldName>;`) without an identifier allowlist. An attacker field name like `pwn; public function __construct(){system($_GET['cmd']);} private $z` produces valid PHP that executes when the class is instantiated via `DataObject::getById()` or similar. The same field name is also concatenated (with weak backtick quoting) into ALTER TABLE DDL statements, enabling SQL injection. The attack is reachable via the `/class/definition/configuration-view/detail/{id}/import` POST endpoint, which requires only the standard "objects" permission (not admin), and performs no field-name validation. The RCE sink has been confirmed in an isolated harness using the unmodified builder source; the end-to-end exploit chain (import path preservation → DDL execution → object instantiation → constructor invocation) is reasoned from source code. This is a sibling of CVE-2026-5394 (composite-index SQL injection), whose fix hardened only the `compositeIndices` sink and missed the field-name path.Affected products
- Pimcore Pimcore <= 12.3.9 or (>= 2026.1.0 and <= 2026.1.5)
Timeline
- 2026-05-29: disclosed: Vulnerability discovered during sibling sweep of CVE-2026-5394
- 2026-07-30: advisory: GitHub Security Advisory published
- 2026-08-28: patched: Fixed in Pimcore 12.3.10 and 2026.1.6