CVE-2026-55072: Pimcore SQL Injection Vulnerability

CVE-2026-55072 Overview

Pimcore is an open source data and experience management platform used to model, manage, and deliver structured content. CVE-2026-55072 is a SQL injection vulnerability affecting Pimcore versions prior to 2026.1.5. An authenticated user holding the objects permission can submit a malicious ClassDefinition unique identifier (UID) that bypasses server-side validation. The stored identifier later flows into an unquoted table name inside Block::load, allowing attacker-controlled SQL syntax to reach the database. Successful exploitation can read or modify arbitrary Pimcore tables, including disclosure of stored password hashes.

Critical Impact
An authenticated user with the objects permission can execute arbitrary SQL against the Pimcore database, exposing password hashes and enabling tampering with any Pimcore-managed table.

Affected Products

Pimcore Platform versions prior to 2026.1.5
models/DataObject/ClassDefinition.php name and ID validators
models/DataObject/ClassDefinition/Data/Block.php (Block::load)

Discovery Timeline

2026-09-14 - CVE-2026-55072 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database
Fix released - Pimcore v2026.1.5 addresses the issue
Advisory published - GitHub Security Advisory GHSA-2mhj-fhvg-v428

Technical Details for CVE-2026-55072

Vulnerability Analysis

The flaw is an input validation weakness ([CWE-20]) that escalates into SQL injection. Pimcore validates the name and id properties of a ClassDefinition using regular expressions in models/DataObject/ClassDefinition.php. Those expressions include a start anchor but omit an end anchor, so validation only checks the beginning of each value. An attacker can prepend valid characters and append arbitrary SQL fragments.

The malicious UID is persisted with the class definition. When a data object of that class containing a Block field is loaded, Block::load in models/DataObject/ClassDefinition/Data/Block.php concatenates the stored class ID into an unquoted table identifier. The resulting query executes attacker-supplied syntax against the Pimcore database.

Root Cause

The root cause is incomplete hardening of prior validation logic. Earlier work introduced a ^ start anchor for the name and ID regex checks but did not require a $ end anchor, so any suffix passes validation. Combined with unquoted identifier interpolation in Block::load, the stored UID becomes a SQL injection sink.

Attack Vector

Exploitation is network-reachable and requires an authenticated Pimcore account with the objects permission. The attacker submits a crafted ClassDefinition whose ID contains SQL syntax appended to an otherwise valid prefix. Loading any data object of that class triggers the tainted query. Data confidentiality is high; integrity impact is partial because the attacker can also modify rows referenced by generated queries.

php

// Patch: models/DataObject/ClassDefinition.php
// Source: https://github.com/pimcore/pimcore/commit/33a0e1887e1e31b4283b016ac5440c35ea5697b4

            $this->setId((string) $maxId);
        }

-        if (!preg_match('/^[a-zA-Z]\w+/', $this->getName())) {
-            throw new Exception(sprintf('Invalid name for class definition: %s', $this->getName()));
+        if (!preg_match('/^[a-zA-Z]\w+$/', $this->getName())) {
+            throw new Exception(sprintf(
+                'Invalid name for class definition: %s',
+                $this->getName()
+            ));
        }

-        if (!preg_match('/^[a-zA-Z0-9]([a-zA-Z0-9_]+)?/', $this->getId())) {
-            throw new Exception(sprintf('Invalid ID `%s` for class definition %s', $this->getId(), $this->getName()));
+        if (!preg_match('/^[a-zA-Z0-9][a-zA-Z0-9_]*$/', $this->getId())) {
+            throw new Exception(sprintf(
+                'Invalid ID `%s` for class definition %s',
+                $this->getId(),
+                $this->getName()
+            ));
        }

The patch adds the missing $ end anchor to both regular expressions so validation covers the entire identifier. The companion pull request also introduces quoting around block table identifiers in Block::load.

Detection Methods for CVE-2026-55072

Indicators of Compromise

ClassDefinition records whose id or name fields contain non-alphanumeric characters, whitespace, quotes, or SQL keywords such as UNION, SELECT, or --.
Unexpected read access to sensitive tables such as users or any table storing password hashes originating from the Pimcore application user.
Application logs showing Block::load executing queries against unrecognized or malformed table identifiers.
New or modified ClassDefinition entries created by non-administrator accounts holding the objects permission.

Detection Strategies

Audit the classes directory and database for ClassDefinition IDs and names that do not match the strict pattern ^[a-zA-Z0-9][a-zA-Z0-9_]*$.
Enable database query logging on the Pimcore MySQL or MariaDB instance and alert on queries referencing object_ tables with suspicious identifiers.
Correlate authenticated Pimcore admin activity with database read volume spikes, particularly against credential tables.

Monitoring Recommendations

Forward Pimcore application logs and database audit logs to a centralized analytics pipeline for retention and correlation.
Alert on any HTTP requests to /admin/class/save or class definition import endpoints from accounts that do not normally manage schemas.
Baseline the set of legitimate ClassDefinition identifiers and alert on deviations after deployment windows.

How to Mitigate CVE-2026-55072

Immediate Actions Required

Upgrade Pimcore to version 2026.1.5 or later without delay.
Review all existing ClassDefinition records and remove or rename any whose ID or name fails the strict regex ^[a-zA-Z0-9][a-zA-Z0-9_]*$.
Rotate credentials for all Pimcore administrative and application users, assuming password hashes may have been disclosed.
Restrict the objects permission to trusted administrators until the upgrade is complete.

Patch Information

The issue is fixed in Pimcore v2026.1.5. The corrective changes are in commit 33a0e18 and pull request #19177. The patch enforces full-string regex validation on class definition IDs and names and adds identifier quoting to block table references in Block::load. Refer to the GitHub Security Advisory GHSA-2mhj-fhvg-v428 for full details.

Workarounds

Temporarily revoke the objects permission from non-administrator roles until the platform is patched.
Place a web application firewall (WAF) rule in front of Pimcore admin endpoints to reject class definition payloads containing SQL metacharacters in the id or name fields.
Manually validate stored ClassDefinition records against the strict regex before loading data objects that contain Block fields.

bash

# Verify installed Pimcore version and upgrade via Composer
composer show pimcore/pimcore | grep versions
composer require pimcore/pimcore:^2026.1.5 --with-all-dependencies
bin/console cache:clear
bin/console pimcore:deployment:classes-rebuild