CVE-2026-55634: Pimcore Data Management Platform RCE Vulnerability

CVE-2026-55634 Overview

CVE-2026-55634 is a critical vulnerability in Pimcore, an open-source Data and Experience Management Platform. The class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import accepts DataObject field names without enforcing an identifier allowlist. An authenticated user holding the objects permission can inject PHP syntax into generated class files under var/classes/DataObject/ and inject SQL identifier content into ALTER TABLE statements. The flaw is fixed in Pimcore versions 11.5.19, 12.3.10, and 2026.1.6.

Critical Impact
Authenticated attackers can achieve remote code execution and manipulate database schema by injecting arbitrary PHP and SQL through unvalidated DataObject field names.

Affected Products

Pimcore versions prior to 11.5.19
Pimcore versions prior to 12.3.10
Pimcore versions prior to 2026.1.6

Discovery Timeline

2026-08-28 - CVE-2026-55634 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-55634

Vulnerability Analysis

The vulnerability originates in Pimcore's class-definition import workflow. The endpoint accepts a DataObject field name and passes it into two downstream code paths without character validation. In lib/DataObject/ClassBuilder/FieldDefinitionPropertiesBuilder.php, the field name is emitted directly into generated PHP class properties. In models/DataObject/ClassDefinition/Helper/Dao.php, the same value is concatenated into SQL identifiers used in ALTER TABLE statements.

An authenticated user with the objects permission can supply a field name containing semicolons, braces, backticks, spaces, or other syntax characters. When Pimcore instantiates an object of the affected class, the injected PHP executes with the privileges of the web application. Simultaneously, the injected SQL identifier content executes against the backend database. This maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command, compounded by PHP code injection.

Root Cause

The central setName() method in models/DataObject/ClassDefinition/Data.php did not reject non-identifier characters. Validation failed to enforce a strict allowlist of alphanumeric and underscore characters, allowing attacker-controlled tokens to reach code and query generators unchanged.

Attack Vector

The attack requires network access to the Pimcore Studio API and an authenticated account with the objects permission. The attacker submits a crafted class-definition import payload where a field name embeds PHP or SQL syntax. Code execution triggers on the next instantiation of an object using the mutated class definition.

php

// Security patch excerpt: models/DataObject/ClassDefinition/Data.php
 use Closure;
 use Exception;
+use InvalidArgumentException;
 use JsonSerializable;
 use Pimcore\Db\Helper;
 use Pimcore\Model;

Source: Pimcore commit a4f8c3c. The patch introduces InvalidArgumentException handling as part of hardening field name validation to reject unsafe identifier characters.

Detection Methods for CVE-2026-55634

Indicators of Compromise

Unexpected PHP files or modified class definitions under var/classes/DataObject/ containing non-identifier characters such as semicolons, braces, or backticks.
Access log entries hitting /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import from accounts that do not typically manage class definitions.
Database audit records showing ALTER TABLE statements with malformed or attacker-controlled column identifiers.

Detection Strategies

Monitor generated files under var/classes/DataObject/ for content that deviates from the expected class template or contains PHP tokens outside standard property declarations.
Inspect Pimcore Studio API requests targeting class-definition endpoints for JSON payloads containing field names with special characters.
Correlate authenticated sessions holding the objects permission with subsequent web shell indicators or outbound network callbacks from the Pimcore host.

Monitoring Recommendations

Enable file integrity monitoring on var/classes/DataObject/ and alert on any modification not originating from a controlled deployment pipeline.
Log and review MySQL general query logs for schema-changing statements originating from the Pimcore application user.
Track privilege assignments of the objects permission and alert on new grants outside change control.

How to Mitigate CVE-2026-55634

Immediate Actions Required

Upgrade Pimcore to version 11.5.19, 12.3.10, or 2026.1.6 depending on the deployed branch.
Audit user accounts holding the objects permission and revoke access for users who do not require class-definition management.
Review var/classes/DataObject/ for tampered class files and restore known-good versions from source control.

Patch Information

The fix is delivered in Pimcore 11.5.19, 12.3.10, and 2026.1.6. See the Pimcore GHSA-9x44-4gxf-8c25 security advisory, the pull request #19183, and the v2026.1.6 release notes for details.

Workarounds

Restrict the objects permission to trusted administrators until patching is complete.
Place the Pimcore Studio API behind network-level access controls that limit administrative endpoints to known operator IP ranges.
Enforce read-only filesystem permissions on var/classes/DataObject/ outside of scheduled deployment windows.

bash

# Verify installed Pimcore version and confirm patched release
composer show pimcore/pimcore | grep versions
# Expected output should include 11.5.19, 12.3.10, or 2026.1.6