CVE-2026-23493

An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata, leading to unintended SQL execution in the backend.

Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injection patch in the Admin Search Find API allows an authenticated attacker to perform blind SQL injection. Although CVE-2023-30848 attempted to mitigate SQL injection by removing SQL comments (--) and catching syntax errors, the fix is insufficient. Attackers can still inject SQL payloads that do not rely on comments and infer database information via blind techniques. This vulnerability affects the admin interface and can lead to database information disclosure. This vulnerability is fixed in 12.3.1 and 11.5.14.

SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter to admin/asset/grid-proxy.

Pimcore prior to versions 11.5.19, 12.3.10, and 2026.1.6 has a vulnerability in the class-definition import endpoint where a DataObject field name is emitted without an identifier allowlist, allowing an authenticated user with objects permission to inject PHP syntax into generated DataObject classes and inject SQL identifier content into schema-changing statements. The setName() validation did not reject semicolons, braces, backticks, spaces, or other non-identifier characters.

Pimcore before versions 11.5.19, 12.3.10, and 2026.1.6 has a vulnerability in Hotspotimage::getDataFromResource() that passes the __hotspots column to Pimcore\Tool\Serialize::unserialize() without an allowed-classes restriction after JSON decoding fails. An attacker with the ability to write crafted PHP serialized bytes into that column can instantiate available classes and trigger magic methods, potentially leading to arbitrary file writes or code execution. This issue is fixed for Hotspotimage in versions 11.5.19, 12.3.10, and 2026.1.6.

Pimcore before versions 11.5.17 (LTS) and 12.3.6 has inconsistent authorization between the report listing and report detail endpoints in CustomReports. A low-privileged backend user with the 'reports' permission can read an unshared report by name, accessing metadata, data source configuration, and sharing settings.

Vulnerability in Pimcore before versions 11.5.17 (LTS) and 12.3.7. The WebDAV endpoint `/asset/webdav{path}` allows MOVE operation without authentication, enabling an unauthorized attacker to delete, move, or overwrite assets.

Pimcore prior to versions 11.5.17 (LTS) and 12.3.6 contains an SQL injection vulnerability in the columnConfigAction endpoint. An attacker with reports_config permission can execute arbitrary SELECT queries, use UNION statements, dangerous database functions, and error-based SQL injection to exfiltrate or manipulate data.

Pimcore prior to versions 11.5.17 (LTS) and 12.3.7 has a vulnerability in the WordExport export flow. It only checks the word_export feature permission and directly resolves attacker-controlled type/id input without enforcing view permission on page, snippet, email, or object elements, allowing a low-privileged backend user to export document content the user is not allowed to view.

Pimcore before versions 11.5.17 (LTS) and 12.3.7 calls PHP unserialize() on data from database columns and files without the allowed_classes restriction in multiple locations, including lib/Tool/Authentication.php. This enables object injection and remote code execution if an attacker can control the serialized data source.