CVE-2026-55634

Pimcore versions before 11.5.19, 12.3.10, and 2026.1.6 fail to validate DataObject field names against an identifier allowlist in the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import, because the central setName() validation did not reject characters such as semicolons, braces, backticks, and spaces. An authenticated user holding the objects permission can submit a crafted field name that is injected without sanitization into generated PHP class files under var/classes/DataObject/ and into ALTER TABLE identifiers, mapping to CWE-94 (code injection) and CWE-89 (SQL injection). The injected PHP executes whenever an object of that class is instantiated, giving the attacker server-side remote code execution as the web application, while injected identifier text can alter or manipulate schema-changing SQL statements. Any Pimcore deployment running an affected release line where users with the objects permission can reach the Pimcore Studio API is affected, which is a scope-changing issue with high impact on confidentiality, integrity, and availability. Exploitation has not been observed: there is no known public proof-of-concept, the CVE is not in CISA's KEV catalog, and EPSS puts the 30-day exploitation probability at only about 0.4%.

What to do: Upgrade to Pimcore 11.5.19, 12.3.10, or 2026.1.6 depending on your release line. Until patched, restrict access to the Pimcore Studio API and limit the users assigned the objects permission, since exploitation requires such an account. After upgrading, audit existing class definitions and generated files under var/classes/DataObject/ for field names containing semicolons, braces, backticks, spaces, or other non-identifier characters, as previously injected definitions persist and can still trigger execution.