CVE-2026-72562

HighCVSS 8.8

Published: 11/08/2026(UTC)Updated: 11/08/2026(UTC)Translated: 11/08/2026(UTC)NVD NIST

Summary

An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id filter. The filter value is concatenated into the SQL WHERE clause without parameterization.

Risk Assessment

The organization is exposed to exfiltration or modification of the entire database, potentially compromising data confidentiality and integrity.

Recommendation

Update admin-ui-classic-bundle to a patched version or use parameterized SQL queries.

Original NVD description (English source)

An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause without parameterization. An attacker with backend access can exfiltrate or modify all database contents.