CVE-2026-55072 with a CVSS score of 8.5 is a vulnerability in Pimcore where an authenticated user with the objects permission can inject arbitrary SQL that executes when any data object of the malicious class is loaded, allowing exfiltration of any table in the Pimcore database, including the users table containing password hashes, using a UNION-based injection. The vulnerable components include the ClassDefinition UID validation regex and the unquoted classId concatenation in Block.php. The vulnerability arises from a missing end anchor ($ ) in the ClassDefinition UID validation regex, which allows an attacker to create a malicious class with a SQL-injected UID that passes the broken regex but is later executed as part of a SQL query when any data object of the malicious class is loaded. This can be exploited via the Pimcore Studio UI or API by creating a class definition with a malicious UID and then adding a Block field to it, which allows an attacker to inject arbitrary SQL that executes when the data object is loaded. The affected versions are >= 2026.1.0, <= 2026.1.4 for the pimcore/pimcore package and < 12.3.9 for the same package.
We recommend you to update Pimcore to version 2026.1.5 or 12.3.9.[/subscribe_to_unlock_form]
CVE-2026-55072 with a CVSS score of 8.5 is a vulnerability in Pimcore where an authenticated user with the objects permission can inject arbitrary SQL that executes when any data object of the malicious class is loaded, allowing exfiltration of any table in the Pimcore database, including the users table containing password hashes, using a UNION-based injection. The vulnerable components include the ClassDefinition UID validation regex and the unquoted classId concatenation in Block.php. The vulnerability arises from a missing end anchor ($ ) in the ClassDefinition UID validation regex, which allows an attacker to create a malicious class with a SQL-injected UID that passes the broken regex but is later executed as part of a SQL query when any data object of the malicious class is loaded. This can be exploited via the Pimcore Studio UI or API by creating a class definition with a malicious UID and then adding a Block field to it, which allows an attacker to inject arbitrary SQL that executes when the data object is loaded. The affected versions are >= 2026.1.0, <= 2026.1.4 for the pimcore/pimcore package and < 12.3.9 for the same package.
We recommend you to update Pimcore to version 2026.1.5 or 12.3.9.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]