CVE-2025-27617: Pimcore SQL Injection Vulnerability

CVE-2025-27617 Overview

CVE-2025-27617 is a SQL injection vulnerability in Pimcore, an open source data and experience management platform. Authenticated users can craft a malicious filter string that is passed to the RelationFilterConditionParser without proper quotation, leading to SQL injection against the underlying database. The flaw affects versions of Pimcore prior to 11.5.4 and was resolved by improving quotation handling in the affected parser. The vulnerability is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the Pimcore database, compromising confidentiality, integrity, and availability of stored data.

Affected Products

Pimcore Pimcore versions prior to 11.5.4
Component: models/DataObject/ClassDefinition/Data/Extension/RelationFilterConditionParser.php
Component: models/DataObject/ClassDefinition/Data/Multiselect.php

Discovery Timeline

2025-03-11 - CVE-2025-27617 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27617

Vulnerability Analysis

The vulnerability resides in Pimcore's RelationFilterConditionParser trait, which processes filter strings supplied by authenticated users. User-controlled input is concatenated into SQL fragments without proper quoting or parameterization. An attacker with a valid Pimcore account can craft filter parameters that break out of the intended query context and inject arbitrary SQL clauses.

The fix introduces the Pimcore\Db\Helper utility to apply proper quoting when constructing filter conditions. The Multiselect data type, which relies on the parser, was also affected because it forwards user filter values into the same code path.

Root Cause

The root cause is improper neutralization of special elements in an SQL command [CWE-89]. The RelationFilterConditionParser built WHERE-clause fragments by string concatenation using values derived from filter input. Without database-level escaping or bound parameters, quote characters and SQL syntax within the filter string were interpreted as part of the query.

Attack Vector

Exploitation requires network access to the Pimcore backend and valid authenticated credentials with permission to query filtered data objects. The attacker submits a request containing a crafted filter string against an endpoint that invokes the vulnerable parser, such as a Multiselect field filter. The injected SQL executes with the privileges of the Pimcore database user.

php

 namespace Pimcore\Model\DataObject\ClassDefinition\Data\Extension;

+use Pimcore\Db\Helper;
+
 /**
  * Trait RelationFilterConditionParser
  *

Source: Pimcore commit 19a8520 — the patch imports the Helper class to apply proper database quoting inside the filter parser.

Detection Methods for CVE-2025-27617

Indicators of Compromise

HTTP requests to Pimcore admin or data object endpoints containing SQL metacharacters such as single quotes, UNION, SELECT, or comment sequences (--, /*) in filter parameters.
Database error entries or unexpected long-running queries originating from Pimcore's application user.
Authenticated session activity from accounts submitting anomalous filter values to Multiselect or relation fields.

Detection Strategies

Inspect Pimcore application logs and web server access logs for filter parameters containing SQL keywords or encoded quote characters.
Enable MySQL or MariaDB general query logging temporarily to identify queries containing unquoted user input in WHERE clauses on data object tables.
Correlate authenticated user IDs with abnormal query volume or query patterns that deviate from typical UI-driven filtering.

Monitoring Recommendations

Deploy a web application firewall rule set that flags SQL injection payloads in filter parameters targeting Pimcore endpoints.
Alert on database errors referencing syntax errors from the Pimcore application account.
Review Pimcore user roles to identify accounts with data object read privileges that could reach the vulnerable parser.

How to Mitigate CVE-2025-27617

Immediate Actions Required

Upgrade Pimcore to version 11.5.4 or later, which contains the fix in commit 19a8520.
Audit Pimcore user accounts and revoke unnecessary access to data object filtering functionality.
Rotate database credentials if unauthorized filter activity is identified in logs.

Patch Information

Pimcore released version 11.5.4 to remediate the SQL injection. The fix is applied in commit 19a8520895484e68fd254773e32476565d91deea and documented in GitHub Security Advisory GHSA-qjpx-5m2p-5pgh. The patch adds the Pimcore\Db\Helper import and applies proper quoting inside RelationFilterConditionParser.

Workarounds

Restrict access to authenticated Pimcore backend users only, and limit the number of accounts with permission to query relational data objects.
Place Pimcore behind a web application firewall configured with SQL injection signatures until the upgrade is applied.
Enforce least privilege on the Pimcore database account to limit the impact of any successful injection.

bash

# Upgrade Pimcore via Composer to the patched release
composer require pimcore/pimcore:^11.5.4
composer update pimcore/pimcore --with-dependencies
bin/console cache:clear