CVE-2026-72562
Received Received - Intake

SQL Injection in Pimcore admin-ui-classic-bundle

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause without parameterization. An attacker with backend access can exfiltrate or modify all database contents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72562
EUVD
EUVD-2026-56032

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
pimcore admin-ui-classic-bundle to 2.3 (inc)
pimcore admin-ui-classic-bundle to 2.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an SQL injection vulnerability in Pimcore's admin-ui-classic-bundle up to version 2.3. Authenticated backend users can execute arbitrary SQL commands by manipulating the DataObject grid id column filter. The filter value is directly concatenated into the SQL WHERE clause without proper parameterization, allowing attackers to read or modify all database contents.

Detection Guidance

Check Pimcore admin-ui-classic-bundle version for 2.3 or lower. Inspect SQL queries for unsanitized input in DataObject grid filters. Monitor backend user activity for unusual database access patterns.

Impact Analysis

If you use Pimcore admin-ui-classic-bundle version 2.3 or earlier, an attacker with backend access could steal sensitive data, alter or delete database records, or gain full control over the system. This requires authenticated access, but the impact is severe as it affects all database contents.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face compliance breaches, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade to a patched version of Pimcore admin-ui-classic-bundle if available. Implement input validation for all user-provided data in filters. Restrict backend user permissions to least privilege. Disable the bundle if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72562. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart