CVE-2026-55072 Details
Description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the beginning of each value. When a data object of that class containing a Block field is loaded, Block::load in models/DataObject/ClassDefinition/Data/Block.php incorporates the stored class ID into an unquoted object table identifier, allowing the UID to supply SQL syntax. The resulting query can read or modify arbitrary Pimcore database tables, including disclosure of password hashes, and the flaw represents an incomplete validation hardening because earlier work added a start anchor without enforcing the end of the identifier. This issue is fixed in version 2026.1.5.
A SQL injection vulnerability has been identified in Pimcore versions prior to 2026.1.5. The issue arises from a regex validation flaw in the ClassDefinition UID, allowing an authenticated user with objects permission to inject malicious SQL. When a data object of the compromised class is accessed, the injected SQL is executed, potentially altering or disclosing data from any Pimcore database table, including sensitive information such as password hashes.
Users can update to Pimcore version 2026.1.5 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pimcore/pimcore/security/advisories/GHSA-2mhj-fhvg-v428 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/pimcore/pimcore/commit/33a0e1887e1e31b4283b016ac5440c35ea5697b4 | [email protected] | Source CodeVendor |
| https://github.com/pimcore/pimcore/pull/19177 | [email protected] | Source CodeVendor |
| https://github.com/pimcore/pimcore/releases/tag/v2026.1.5 | [email protected] | Release NotesVendor |
| https://github.com/pimcore/pimcore/security/advisories/GHSA-2mhj-fhvg-v428 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Pimcore | <= 2026.1.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |