CVE-2026-55072

Pimcore versions before 2026.1.5 contain an SQL injection caused by incomplete input validation: the name/ID expressions in models/DataObject/ClassDefinition.php only check the start of the value, so an authenticated user with the objects permission can store a malicious ClassDefinition UID containing SQL syntax. When a data object of that class with a Block field is loaded, Block::load interpolates the stored class ID into an unquoted object table identifier, executing the attacker's SQL against the database. A successful exploit can read or modify arbitrary Pimcore database tables, including disclosure of user password hashes. The issue stems from earlier hardening that added a start anchor to validation without anchoring the end of the identifier, and it is fixed in version 2026.1.5. No public proof of concept or exploitation in the wild is known.

What to do: Upgrade to Pimcore 2026.1.5 or later as soon as possible. In the interim, restrict the 'objects' permission (especially class definition editing) to trusted administrators only, and review the ClassDefinition tables for class IDs/UIDs containing unexpected characters or SQL syntax. Audit database query logs for anomalous statements targeting non-Pimcore-object tables, and rotate admin/user credentials if there is any sign password hashes were accessed.