Pimcore DataObject SQL Injection (CVE-2026-5394)

Vulnerability Key Information Summary Vulnerability Overview Vulnerability Name: Pimcore Platform – SQL Injection in DataObject Composite Index Handling (CVE-2026-5394) Type: SQL Injection Severity: High (CVSS 7.9/10) Root Cause: directly accepts the from the imported JSON. does not perform whitelist validation for index names/column names. constructs and executes SQL through string concatenation, causing attacker-controllable content to be concatenated into the statement. Scope of Impact Affected Versions: and Fixed Versions: and Impact: Attackers with administrative privileges can inject additional DDL clauses when importing/saving class definitions, allowing them to modify the schema of the object tables associated with DataObjects (e.g., dropping columns, altering the schema). This may compromise data integrity or cause backend service disruptions. Remediation Upgrade to fixed version 12.3.7 or 11.5.17. Core fix: Add whitelist/escaping validation for identifiers such as and to avoid direct string concatenation into SQL. PoC / Exploitation Code Minimal Malicious JSON Snippet (Application Layer PoC): Generated SQL After Injection: Key Source Code (Lacking Escaping/Whitelist Validation): Reproduction Steps: 1. Log in as an administrator with permissions to manage object class definitions. 2. Export or prepare a class definition JSON containing . 3. Modify only the field (e.g., use the malicious snippet above). 4. Import/save the definition via the management endpoint. 5. Expected result: executes an attacker-influenced , unexpectedly modifying the target object table.

Goal Reached Thanks to every supporter — we hit 100%!

Pimcore DataObject SQL Injection (CVE-2026-5394)

More from this source