CVE-2026-27461: Pimcore SQL Injection Vulnerability

CVE-2026-27461 Overview

CVE-2026-27461 is a SQL Injection vulnerability affecting Pimcore, an Open Source Data & Experience Management Platform. In versions up to and including 11.5.14.1 and 12.3.2, the filter query parameter in the dependency listing endpoints is JSON-decoded and the value field is concatenated directly into RLIKE clauses without sanitization or parameterized queries. While exploiting this issue requires admin authentication, an attacker with admin panel access can extract the full database including password hashes of other admin users.

Critical Impact

Authenticated attackers with admin access can exploit this SQL Injection flaw to extract sensitive database contents, including password hashes of other administrative users, potentially leading to full system compromise.

Affected Products

• Pimcore versions up to and including 11.5.14.1
• Pimcore versions up to and including 12.3.2
• All Pimcore installations using vulnerable dependency listing endpoints

Discovery Timeline

• 2026-02-24 - CVE-2026-27461 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-27461

Vulnerability Analysis

This SQL Injection vulnerability exists in Pimcore's dependency listing endpoints. The root issue stems from improper handling of user-controlled input within the filter query parameter. When the platform processes requests to dependency listing endpoints, it JSON-decodes the filter parameter and directly concatenates the value field into SQL RLIKE clauses without proper sanitization or the use of parameterized queries.

While exploitation requires authenticated admin access, this significantly lowers the barrier for insider threats or scenarios where admin credentials have been compromised through other means. A successful attack allows the extraction of the entire database contents, including sensitive information such as password hashes for administrative users.

Root Cause

The vulnerability originates from inadequate input validation and the absence of parameterized queries in the dependency listing functionality. The application directly interpolates user-supplied JSON values into SQL RLIKE clauses, creating a classic SQL Injection attack surface. This represents a CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) weakness.

Attack Vector

The attack is network-based and can be executed remotely by an authenticated administrator. An attacker would craft malicious JSON payloads within the filter query parameter when accessing the dependency listing endpoints. The injected SQL fragments bypass normal query logic, enabling unauthorized data retrieval through boolean-based or time-based blind SQL injection techniques.

The vulnerability mechanism involves sending specially crafted filter parameters to the dependency listing endpoints. The JSON-decoded value field is not sanitized before being included in RLIKE clauses, allowing attackers to inject arbitrary SQL commands. Successful exploitation enables complete database extraction, including password hashes that could be cracked offline or used for credential stuffing attacks against other systems. For technical implementation details, see the GitHub Security Advisory.

Detection Methods for CVE-2026-27461

Indicators of Compromise

• Unusual database queries containing RLIKE clauses with unexpected or malformed patterns in application logs
• Abnormal access patterns to dependency listing endpoints from administrative accounts
• Database query errors or timeouts that may indicate blind SQL injection attempts
• Unexpected data extraction activities or large result sets from dependency listing queries

Detection Strategies

• Monitor web application firewall (WAF) logs for SQL injection patterns targeting dependency endpoints
• Implement database activity monitoring to detect unauthorized SELECT queries against sensitive tables
• Review admin user access logs for suspicious activity patterns or unusual access times
• Configure intrusion detection systems to alert on SQL injection signatures in HTTP requests

Monitoring Recommendations

• Enable verbose logging for all dependency listing endpoint requests
• Set up alerts for failed SQL query attempts that may indicate injection probing
• Monitor for unusual database read operations, particularly bulk data extraction
• Track admin session activity for anomalous behavior patterns

How to Mitigate CVE-2026-27461

Immediate Actions Required

• Upgrade Pimcore to version 12.3.3 or later immediately
• Review admin user accounts for any unauthorized access or suspicious activity
• Audit database access logs for evidence of exploitation
• Consider rotating administrative credentials as a precautionary measure

Patch Information

Pimcore has released version 12.3.3 which contains a fix for this vulnerability. The patch implements proper input sanitization and parameterized queries for the dependency listing endpoints. Organizations should apply this update as soon as possible. The fix details can be reviewed in the GitHub Commit and Pull Request #18991. The patched release is available at GitHub Release v12.3.3.

Workarounds

• Restrict admin panel access to trusted IP addresses using network-level controls
• Implement additional WAF rules to filter SQL injection attempts in the filter parameter
• Limit administrative privileges to the minimum required for each role
• Enable database query logging and monitoring to detect exploitation attempts

# Example: Restrict admin access via nginx configuration
location /admin {
    allow 10.0.0.0/8;
    allow 192.168.1.0/24;
    deny all;
}