CVE-2025-27617: SQL Injection Vulnerability in Pimcore Package
Summary
CVE-2025-27617: Pimcore Vulnerable to SQL Injection in getRelationFilterCondition. Affects pimcore/pimcore versions < 11.5.4. Fixed in 11.5.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pimcore is an open-source digital experience platform that provides tools for managing digital assets, content, and data. It is widely used for building websites, e-commerce platforms, and applications. The platform allows users to create and manage complex data structures, making it a powerful tool for developers and businesses. However, it has been found to be vulnerable to SQL injection attacks due to insufficient input sanitization in its RelationFilterConditionParser component.
Vulnerability Detail
The vulnerability arises from the lack of input sanitization in the getRelationFilterCondition method of the RelationFilterConditionParser class. Authenticated users can manipulate filter strings to execute arbitrary SQL commands, potentially leading to unauthorized data access or data manipulation. This vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The affected code can be found in the RelationFilterConditionParser.php file, specifically between lines 29 and 47.
How To Fix
Minimum fixed version
11.5.4
This is the first release that contains the fix.
composer require pimcore/pimcore:11.5.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation and sanitization on the filter strings before they are processed by the RelationFilterConditionParser. This can help mitigate the risk of SQL injection until the package is updated.
Conclusion
The CVE-2025-27617 vulnerability in the Pimcore package poses a significant risk due to SQL injection possibilities. It is crucial for users to update to the latest version to protect their applications from potential attacks. Implementing workarounds can provide temporary relief until the update is applied.
See every vulnerability recorded for pimcore/pimcore →
FAQ
CVE-2025-27617 is a vulnerability in the Pimcore package that allows authenticated users to perform SQL injection attacks due to insufficient input sanitization.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
The consequences include unauthorized access to sensitive data, data manipulation, and potential compromise of the application’s integrity.
Yes, a patch is available in version 11.5.4 of the Pimcore package. Updating to this version will resolve the vulnerability.
If you cannot update immediately, implement input validation and sanitization as a temporary measure to mitigate the risk of SQL injection.
References
Related vulnerabilities
Recent vulnerabilities recorded for pimcore/pimcore.
