CVE-2026-55634
Received Received - Intake

Code Injection in Pimcore DataObject Class

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import accepts a DataObject field name that is emitted without an identifier allowlist by lib/DataObject/ClassBuilder/FieldDefinitionPropertiesBuilder.php into generated PHP properties and by models/DataObject/ClassDefinition/Helper/Dao.php into ALTER TABLE identifiers. An authenticated user with the objects permission can inject PHP syntax into the generated DataObject class, causing attacker-controlled code in generated var/classes/DataObject/.php files to run when an object of that class is instantiated, and can also inject SQL identifier content into schema-changing statements. The central models/DataObject/ClassDefinition/Data.php::setName() validation did not reject semicolons, braces, backticks, spaces, or other non-identifier characters. This issue is fixed in versions 11.5.19, 12.3.10, and 2026.1.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-29
AI Q&A
2026-08-29
EPSS Evaluated
N/A
NVD
CVE-2026-55634
EUVD
EUVD-2026-67871

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
pimcore pimcore to 11.5.19 (inc)
pimcore pimcore to 12.3.10 (inc)
pimcore pimcore to 2026.1.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Pimcore allows authenticated users with object permissions to inject PHP syntax into generated DataObject classes. The issue occurs in the class-definition import endpoint where field names are not properly validated. Attackers can inject malicious code into var/classes/DataObject/.php files, which executes when objects of that class are instantiated. The root cause is insufficient input validation in the class definition import process.

Detection Guidance

Check for unauthorized or suspicious PHP files in the var/classes/DataObject/ directory. Look for files with unusual names or recent modification dates. Review database schema changes for unexpected ALTER TABLE statements or new tables.

Impact Analysis

An attacker could execute arbitrary code on the server hosting Pimcore, potentially gaining full control over the system. They could also manipulate database schemas by injecting SQL identifiers, leading to unauthorized data access or modification. This could result in data breaches, system compromise, or complete takeover of the Pimcore instance.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized data access or modification risks. GDPR requires protecting personal data integrity, while HIPAA mandates safeguarding protected health information. A successful exploit could lead to unauthorized data exposure, triggering regulatory penalties and legal consequences.

Mitigation Strategies

Upgrade Pimcore to versions 11.5.19, 12.3.10, or 2026.1.6 or later immediately. If immediate upgrade is not possible, restrict access to the /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import endpoint and review all DataObject class definitions for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55634. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart