Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Pimcore import lets authenticated users execute code

CVE-2026-55634 · published 6 days ago
Summary

If you use Pimcore versions older than the latest releases, a user who can log in and has permission to work with objects can trick the system into creating PHP code inside its data‑object classes. That code runs whenever the affected object is used, and the same flaw can alter database commands. Update Pimcore to the newest version to close the issue and restrict object‑import permissions to trusted users.

What to do
  • Update pimcore pimcore/pimcore to version 12.3.10.
  • Update pimcore pimcore/pimcore to version 2026.1.6.
Affected software
Ecosystem VendorProductAffected versions
– pimcore pimcore < 11.5.19
Packagist pimcore pimcore/pimcore < 12.3.10
>= 2026.1.0, < 2026.1.6
Fix: upgrade to 12.3.10
Original advisory text
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-vie...
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import accepts a DataObject field name that is emitted without an identifier allowlist by lib/DataObject/ClassBuilder/FieldDefinitionPropertiesBuilder.php into generated PHP properties and by models/DataObject/ClassDefinition/Helper/Dao.php into ALTER TABLE identifiers. An authenticated user with the objects permission can inject PHP syntax into the generated DataObject class, causing attacker-controlled code in generated var/classes/DataObject/.php files to run when an object of that class is instantiated, and can also inject SQL identifier content into schema-changing statements. The central models/DataObject/ClassDefinition/Data.php::setName() validation did not reject semicolons, braces, backticks, spaces, or other non-identifier characters. This issue is fixed in versions 11.5.19, 12.3.10, and 2026.1.6.
References
Severity
9.9 Critical
CVSS 3.1: 9.9 (MITRE)
Exploitation
EPSS <1%
Type
CWE-89SQL Injection
CWE-94Code Injection
Timeline
Published28 Aug 2026
Updated3 Sep 2026
First seen28 Aug 2026
Sources
CVE-2026-55634 · NVD
CVE-2026-55634 · MITRE
GHSA-9x44-4gxf-8c25 · OSV
Monitor software like this
Free during beta