Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.4

Pimcore 12.3.3 lets admin run unwanted database commands

CVE-2026-5394 · published 6 months ago
Summary

If an administrator can import or save DataObject class definitions, they could insert specially crafted information that makes the system execute unintended database queries. This could allow a malicious insider to view, change, or delete data. Apply the latest Pimcore update and restrict who has permission to import or edit class definitions.

What to do
  • Update pimcore pimcore to version 12.3.7.
  • Update pimcore pimcore/pimcore to version 12.3.7.
  • Update pimcore pimcore to version 11.5.17.
  • Update pimcore pimcore to version 2026.1.3.
Affected software
Ecosystem VendorProductAffected versions
composer pimcore pimcore 12.3.3
<= 12.3.6
>= 12.0.0-RC1, <= 12.3.6
<= 11.5.16
>= 2026.1.0, < 2026.1.3
Fix: upgrade to 12.3.7
Packagist pimcore pimcore/pimcore < 12.3.7
Fix: upgrade to 12.3.7
Original advisory text
Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling
An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger unintended SQL execution in the backend.

This issue affects pimcore: 12.3.3.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
8.4 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published27 Apr 2026
Updated4 Nov 2026
First seen27 Apr 2026
Sources
CVE-2026-5394 · NVD
GHSA-c8g3-x47w-8q7p · GHSA
GHSA-r2f4-ff2p-xc64 · GHSA
GHSA-c8g3-x47w-8q7p · OSV
CVE-2026-5394 · OSV
Track software like this
Free during beta