CVE-2026-44741
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Pimcore Admin Classic Bundle versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in the translation grid date filter. The user-supplied `property` field from the filter JSON is interpolated directly into a `UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...)))` SQL expression without parameterization or allowlist validation. Versions 2.3.6 and 1.7.18 fix the issue.
Risk Assessment
Risk of unauthorized database access, including reading, modifying, or deleting data, potentially leading to confidentiality and integrity breaches.
Recommendation
Update Pimcore Admin Classic Bundle to version 2.3.6 or 1.7.18 (or later) and restrict access to the admin panel.
Original NVD description (English source)
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied `property` field from the filter JSON is interpolated directly into a `UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...)))` SQL expression without parameterization or allowlist validation. Versiosn 2.3.6 and 1.7.18 fix the issue.