CVE-2026-72562: Pimcore Admin UI Classic Bundle SQLi Flaw

CVE-2026-72562 Overview

CVE-2026-72562 is a SQL injection vulnerability [CWE-89] in the Pimcore admin-ui-classic-bundle through version 2.3. The flaw resides in the DataObject grid id column filter, where the supplied filter value is concatenated directly into the SQL WHERE clause without parameterization. Authenticated backend users can execute arbitrary SQL statements against the underlying database. Successful exploitation allows attackers to read, modify, or delete any data stored in the Pimcore database.

Critical Impact
Authenticated backend users can exfiltrate or modify the entire Pimcore database contents through crafted DataObject grid filter values.

Affected Products

Pimcore admin-ui-classic-bundle versions through 2.3
Pimcore installations exposing the DataObject grid interface to authenticated backend users
Any Pimcore deployment that has not applied the vendor patch for CVE-2026-72562

Discovery Timeline

2026-08-11 - CVE-2026-72562 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72562

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] in the Pimcore administrative interface. The DataObject grid view provides column-level filters so backend users can narrow search results. When a user submits a filter value for the id column, the bundle constructs a SQL WHERE clause by concatenating the raw input into the query string. No prepared statement or parameter binding is applied to this input.

An authenticated attacker with backend access can inject arbitrary SQL syntax through the id filter. The injected payload executes with the database privileges of the Pimcore application user, which typically has full read and write access to all Pimcore tables. Impact extends across confidentiality, integrity, and availability of the database.

Root Cause

The root cause is missing input parameterization in the DataObject grid filter handler. The id column filter value is interpolated directly into the SQL statement instead of being passed as a bound parameter through the database abstraction layer. This bypasses the safeguards that would normally prevent user-controlled input from altering query structure.

Attack Vector

Exploitation requires network access to the Pimcore backend and valid authenticated credentials with permission to view a DataObject grid. The attacker submits a crafted filter value against the id column through the standard admin UI or by replaying the underlying HTTP request. The malicious payload extends the WHERE clause with attacker-controlled SQL. This enables UNION-based data extraction, boolean-based blind exfiltration, and destructive statements against any accessible database object.

No verified public proof-of-concept code is available. See the Pimcore admin-ui-classic-bundle repository for source-level context on the affected filter handler.

Detection Methods for CVE-2026-72562

Indicators of Compromise

HTTP requests to Pimcore admin DataObject grid endpoints containing SQL metacharacters such as single quotes, UNION SELECT, OR 1=1, or comment sequences (--, #, /*) in the id filter parameter
Unusual database query volume or unexpected SELECT statements against information_schema originating from the Pimcore application user
Backend user sessions issuing DataObject grid requests at rates or patterns inconsistent with normal editorial workflow
Web server logs showing long or URL-encoded payloads submitted to admin grid filter endpoints

Detection Strategies

Enable web application firewall (WAF) rules targeting SQL injection patterns on all Pimcore admin routes, including grid filter query parameters
Enable database query logging on the Pimcore database and alert on queries containing multiple statements or UNION, LOAD_FILE, or INTO OUTFILE constructs
Correlate authenticated backend user activity with anomalous outbound data transfer volumes to detect exfiltration through blind SQL injection

Monitoring Recommendations

Monitor Pimcore application logs for exceptions raised by the database driver, which often indicate injection attempts that produced malformed SQL
Track backend user authentication events and privileged role assignments to identify accounts that could be leveraged for exploitation
Alert on new or modified Pimcore admin accounts, especially those created outside standard provisioning workflows

How to Mitigate CVE-2026-72562

Immediate Actions Required

Upgrade pimcore/admin-ui-classic-bundle to a version later than 2.3 that includes the fix for CVE-2026-72562 as soon as the patched release is available
Restrict network access to the Pimcore admin interface to trusted networks or VPN users to reduce the exploitable attack surface
Audit all Pimcore backend accounts and disable unused, shared, or over-privileged users
Rotate credentials for any backend accounts that may have been compromised or shared externally

Patch Information

Refer to the Pimcore admin-ui-classic-bundle repository for the official patched release addressing the DataObject grid id filter SQL injection. Apply the update through Composer and validate the installed bundle version after deployment.

Workarounds

Enforce a WAF rule that blocks SQL metacharacters and injection patterns in query parameters targeting Pimcore admin grid endpoints
Restrict the Pimcore backend role permissions so that only a minimal set of trusted users can access DataObject grids until patching is complete
Limit the database account used by Pimcore to the minimum privileges required, avoiding FILE, SUPER, or cross-database access where feasible

bash

# Update the vulnerable bundle via Composer once the patched version is published
composer update pimcore/admin-ui-classic-bundle

# Verify the installed version is later than 2.3
composer show pimcore/admin-ui-classic-bundle | grep versions