CVE-2026-109392

An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata, leading to unintended SQL execution in the backend.

Pimcore is an open source data and experience management platform. Prior to versions 12.3.1 and 11.5.14, the http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensitive information such as database passwords, cookie session data, and other details can be accessed or recovered through the Pimcore backend.

Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injection patch in the Admin Search Find API allows an authenticated attacker to perform blind SQL injection. Although CVE-2023-30848 attempted to mitigate SQL injection by removing SQL comments (--) and catching syntax errors, the fix is insufficient. Attackers can still inject SQL payloads that do not rely on comments and infer database information via blind techniques. This vulnerability affects the admin interface and can lead to database information disclosure. This vulnerability is fixed in 12.3.1 and 11.5.14.

SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter to admin/asset/grid-proxy.

Pimcore prior to versions 11.5.19, 12.3.10, and 2026.1.6 has a vulnerability in the class-definition import endpoint where a DataObject field name is emitted without an identifier allowlist, allowing an authenticated user with objects permission to inject PHP syntax into generated DataObject classes and inject SQL identifier content into schema-changing statements. The setName() validation did not reject semicolons, braces, backticks, spaces, or other non-identifier characters.

Pimcore before versions 11.5.19, 12.3.10, and 2026.1.6 has a vulnerability in Hotspotimage::getDataFromResource() that passes the __hotspots column to Pimcore\Tool\Serialize::unserialize() without an allowed-classes restriction after JSON decoding fails. An attacker with the ability to write crafted PHP serialized bytes into that column can instantiate available classes and trigger magic methods, potentially leading to arbitrary file writes or code execution. This issue is fixed for Hotspotimage in versions 11.5.19, 12.3.10, and 2026.1.6.

Pimcore before versions 11.5.19, 12.3.10, and 2026.1.6 allows an authenticated user with reports_config permission to inject SQL fragments into report configuration fields. Executing the report can disclose, modify, or delete arbitrary database data.

Pimcore before version 2026.1.5 allows an authenticated user with objects permission to submit a malicious ClassDefinition UID that is used in SQL queries without proper quoting. This can lead to reading or modifying arbitrary database tables, including disclosure of password hashes.

Pimcore before versions 11.5.17 (LTS) and 12.3.6 has inconsistent authorization between the report listing and report detail endpoints in CustomReports. A low-privileged backend user with the 'reports' permission can read an unshared report by name, accessing metadata, data source configuration, and sharing settings.

Vulnerability in Pimcore before versions 11.5.17 (LTS) and 12.3.7. The WebDAV endpoint `/asset/webdav{path}` allows MOVE operation without authentication, enabling an unauthorized attacker to delete, move, or overwrite assets.