CVE-2026-44741: Pimcore Admin Classic Bundle SQLi Flaw

CVE-2026-44741 Overview

CVE-2026-44741 is a SQL injection vulnerability [CWE-89] in the Pimcore Admin Classic Bundle, which provides the backend UI for Pimcore. The flaw resides in the translation grid date filter, where the user-supplied property field from the filter JSON is interpolated directly into a UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...))) SQL expression. The input is neither parameterized nor validated against an allowlist. Versions prior to 2.3.6 and 1.7.18 are affected. An authenticated attacker with backend access can manipulate the filter to execute arbitrary SQL against the underlying database.

Critical Impact
An authenticated backend user can leverage the translation grid date filter to run arbitrary SQL, exposing or modifying stored data and undermining application integrity.

Affected Products

Pimcore Admin Classic Bundle versions prior to 2.3.6
Pimcore Admin Classic Bundle versions prior to 1.7.18
Pimcore instances relying on the backend UI translation grid

Discovery Timeline

2026-08-12 - CVE-2026-44741 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-44741

Vulnerability Analysis

The Pimcore backend exposes a translation grid that accepts JSON filter definitions from the client. One filter type handles date comparisons and constructs a SQL fragment using the pattern UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(<property>))). The <property> value originates from user-controlled filter JSON. The code inserts this value into the query string via direct string concatenation. No prepared statement placeholder is used, and no allowlist restricts the value to expected column names.

Because the filter runs server-side inside an authenticated admin request, the injected SQL executes with the database privileges of the Pimcore application. Attackers can chain subqueries, use UNION clauses, or invoke database functions to read arbitrary tables or alter data. The vulnerability requires low-privileged authentication only, and no user interaction is needed once the attacker holds a session.

Root Cause

The root cause is unsafe interpolation of untrusted input into a SQL expression. Column identifiers cannot be bound as parameters in most SQL drivers, so a strict allowlist of legal column names is the correct control. The vulnerable code omitted that validation, allowing arbitrary text to reach the query builder.

Attack Vector

Exploitation requires network access to the Pimcore admin interface and valid credentials with permission to query the translation grid. The attacker sends a crafted POST to the translation grid endpoint with a property field containing SQL syntax. See the GitHub Security Advisory GHSA-h4ph-crvj-9h92 for advisory details and the GitHub Commit Change for the fix.

Detection Methods for CVE-2026-44741

Indicators of Compromise

Requests to Pimcore translation grid endpoints containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA inside the property field.
Application or database logs showing malformed or unusually long UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...))) expressions.
Unexpected admin sessions performing repeated translation filter operations from a single source.

Detection Strategies

Enable query logging on the backing MySQL or MariaDB instance and alert on translation queries containing SQL metacharacters in filter properties.
Deploy a web application firewall rule that inspects JSON filter bodies sent to /admin/translation endpoints for injection patterns.
Correlate authenticated admin requests with anomalous database read volumes or information_schema access.

Monitoring Recommendations

Review Pimcore audit logs for translation filter requests originating from accounts that do not normally use the module.
Monitor outbound database calls for schema enumeration queries and time-based delays consistent with blind SQL injection.
Track failed login attempts followed by successful admin sessions that immediately access translation endpoints.

How to Mitigate CVE-2026-44741

Immediate Actions Required

Upgrade Pimcore Admin Classic Bundle to version 2.3.6 or 1.7.18 as documented in the GitHub Release v2.3.6.
Rotate credentials for any admin accounts suspected of unauthorized use since exposure began.
Review database contents for signs of tampering or unauthorized reads following the upgrade.

Patch Information

The fix is included in Admin Classic Bundle 2.3.6 and 1.7.18. The corresponding source change is available in GitHub Pull Request #1111 and the GitHub Commit Change. The patch enforces validation of the property value before it reaches the SQL expression.

Workarounds

Restrict access to the Pimcore admin interface to trusted networks via VPN or IP allowlisting until patching is complete.
Reduce backend user permissions so that only trusted operators can access the translation module.
Deploy a WAF signature that blocks SQL metacharacters inside JSON property fields addressed to translation grid endpoints.

bash

# Upgrade the vulnerable bundle via Composer
composer require pimcore/admin-ui-classic-bundle:^2.3.6
# Or for the 1.x branch
composer require pimcore/admin-ui-classic-bundle:^1.7.18
composer update pimcore/admin-ui-classic-bundle
bin/console cache:clear