Pimcore DataObject Field Name Injection RCE/SQLi (CVE-2026-55834)

Vulnerability Key Information Summary Vulnerability Overview Vulnerability Name: Remote Code Execution (RCE) via field names defined in DataObject class Vulnerability Type: SQL Injection / Remote Code Execution (RCE) Severity: Critical (CVSS 9.8) Affected Component: (Composer package) Affected Versions: <= 11.5.18, <= 12.3.9 Fixed Versions: 2026.1.6, 12.3.10, 11.5.19 CVE ID: CVE-2026-55834 CWE: CWE-89 (SQL Injection), CWE-94 (Code Injection) Scope of Impact Any authenticated user with permission (content editors) can trigger it Attackers can inject malicious code via field names in the DataObject class definition Field names are directly concatenated when generating DDL statements, without identifier validation Attackers can execute arbitrary PHP code (RCE) and can perform SQL injection on ALTER TABLE DDL Technical Details RCE Injection Point: In , the field name ( ) is directly concatenated into the body of the method, which executes when the class is loaded SQL Injection Point: In , field names are wrapped in backticks and concatenated into statements Validation Defect: Field name validation only checks the class name, not the field name; the reserved word check does not cover field names Remediation 1. Identifier Whitelist Validation: Apply identifier pattern validation to field names (e.g., ) 2. Parameterization/Escape: Properly escape identifiers for field names in DDL generation 3. Version Upgrade: Upgrade to 2026.1.6 / 12.3.10 / 11.5.19 POC / Exploit Code RCE Exploitation (via injection): SQL Injection Exploitation (ALTER TABLE): Full Exploitation Flow (HTTP Endpoint): Browser-Side Trigger (DevTools Console): Server-Side Identifier Validation Patch Example:

Goal Reached Thanks to every supporter — we hit 100%!

Pimcore DataObject Field Name Injection RCE/SQLi (CVE-2026-55834)

More from this source