Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-55072— Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

Quick assessment

Affected
pimcore pimcore
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述的专业中文翻译： Pimcore 是一个开源的数据与体验管理平台。在 2026.1.5 版本之前，拥有“对象”权限的已认证用户可以提交恶意的 ClassDefinition UID（类定义唯一标识符）。这是因为 中用于验证名称和 ID 的校验表达式仅检查每个值的起始部分。当加载包含 Block 字段的数据对象时， 中的 方法会将存储的类 ID 拼接到未加引号的对象表标识符中，从而允许 UID 注入 SQL 语法。由此生成的查询语句可以读取或修改 Pimcore 数据库中任意的表，包括可能泄露密码哈希

CVSS 8.5 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55072

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
Source: CVE Program / CVE List V5
Vulnerability Description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the beginning of each value. When a data object of that class containing a Block field is loaded, Block::load in models/DataObject/ClassDefinition/Data/Block.php incorporates the stored class ID into an unquoted object table identifier, allowing the UID to supply SQL syntax. The resulting query can read or modify arbitrary Pimcore database tables, including disclosure of password hashes, and the flaw represents an incomplete validation hardening because earlier work added a start anchor without enforcing the end of the identifier. This issue is fixed in version 2026.1.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
pimcore pimcore < 2026.1.5 -

II. Public POCs for CVE-2026-55072

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55072

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55072 (2)

Vendor Advisories for CVE-2026-55072 (1)

Vendor Pages for CVE-2026-55072 (1)

IV. Related Vulnerabilities

Same product: pimcore
Same vendor: pimcore
Same weakness: CWE-20

V. Comments for CVE-2026-55072

No comments yet

Leave a comment