CVE-2026-55072
Received Received - Intake

SQL Injection in Pimcore Data Management Platform

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the beginning of each value. When a data object of that class containing a Block field is loaded, Block::load in models/DataObject/ClassDefinition/Data/Block.php incorporates the stored class ID into an unquoted object table identifier, allowing the UID to supply SQL syntax. The resulting query can read or modify arbitrary Pimcore database tables, including disclosure of password hashes, and the flaw represents an incomplete validation hardening because earlier work added a start anchor without enforcing the end of the identifier. This issue is fixed in version 2026.1.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-55072
EUVD
EUVD-2026-77635

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pimcore pimcore to 2026.1.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Pimcore allows an authenticated user with object permissions to submit a malicious ClassDefinition UID. The validation in models/DataObject/ClassDefinition.php only checks the start of the value, not the entire string. When a data object with a Block field is loaded, the Block::load function in models/DataObject/ClassDefinition/Data/Block.php uses this UID in an unquoted SQL identifier, enabling SQL injection. This can lead to reading or modifying arbitrary database tables, including accessing password hashes.

Detection Guidance

Detecting this vulnerability requires checking for Pimcore installations running versions prior to 2026.1.5. Review system logs for unusual database queries or unauthorized access attempts. Inspect ClassDefinition UIDs for malicious patterns in Block fields. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to access sensitive data like password hashes, modify database records, or perform unauthorized actions. If you use Pimcore with user permissions and Block fields, an authenticated user could potentially escalate privileges or steal data. The impact depends on the database contents and system configuration.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. A breach may result in legal penalties, reputational damage, and loss of compliance certifications if exploited.

Mitigation Strategies

Immediately upgrade Pimcore to version 2026.1.5 or later. Remove unnecessary permissions for authenticated users, especially object permissions. Audit database access logs for suspicious activity. Revoke exposed credentials if any have been compromised.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55072. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart