Log in / Sign up

Vulnerability details

CVE-2026-55072

pimcore pimcore

Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

CVSS 3.1
8.5High

Official description

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the beginning of each value. When a data object of that class containing a Block field is loaded, Block::load in models/DataObject/ClassDefinition/Data/Block.php incorporates the stored class ID into an unquoted object table identifier, allowing the UID to supply SQL syntax. The resulting query can read or modify arbitrary Pimcore database tables, including disclosure of password hashes, and the flaw represents an incomplete validation hardening because earlier work added a start anchor without enforcing the end of the identifier. This issue is fixed in version 2026.1.5.

CVSS scores

ScoreVersionSourceVector
8.5High 3.1 CVEProject cvelistV5 (CNA) (GitHub_M) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Affected products

VendorProductVersionsSource
pimcore pimcore < 2026.1.5 CVEProject cvelistV5 (CNA)

References and advisories

4
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-09-14
Last updated
2026-09-14
State
Published
Assigner (CNA)
GitHub_M

Exploit prediction (EPSS)

0.4%
Probability of exploitation in 30 days
35.4%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
No
Exploitation
Proof of concept
Technical impact
Partial

Weaknesses (CWE)

  • CWE-20
    Improper Input Validation
  • CWE-89
    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')