Executive brief
Pimcore's administrative interface bundle contains an SQL injection vulnerability that allows authorized backend users to inject malicious SQL through the DataObject grid filtering feature. An attacker with backend access can read, modify, or delete sensitive data stored in the underlying database, potentially compromising the entire Pimcore CMS installation and all managed content.
Technical details
The vulnerability is a classic SQL injection flaw in the admin-ui-classic-bundle's DataObject grid filtering mechanism. The id column filter value is concatenated directly into SQL WHERE clauses without parameterization or escaping. An authenticated backend user can craft a malicious filter value to break out of the SQL context and execute arbitrary SQL commands. The attack requires valid backend authentication credentials but is otherwise unrestricted. This vulnerability affects admin-ui-classic-bundle through version 2.3; a patch or version upgrade is required to remediate.
Affected products
- Pimcore admin-ui-classic-bundle through 2.3
Timeline
- 2026-08-11: disclosed
- 2026-08-11: advisory: CVE-2026-72562 published on NVD