CVE-2026-44741: SQL Injection Vulnerability in Pimcore Admin Classic Bundle's Translation Grid Date Filter
Summary
CVE-2026-44741: GitHub Security Advisory Draft — GM-369 Summary SQL injection in Pimcore's translation grid date filter — the user-supplied property field from the filter JSON is interpolated directly into a UNIX_TIMESTAMP(DATE(FROM_UNI... Affects pimcore/admin-ui-classic-bundle versions < 2.3.6. Fixed in 2.3.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pimcore is an open-source digital experience platform that provides a robust framework for managing content, assets, and data. The Admin Classic Bundle is a component of Pimcore that facilitates administrative tasks, including managing translations. This bundle allows users to filter translations based on various criteria, including date filters. However, a vulnerability exists in how user input is handled within the translation grid, specifically related to SQL queries, making it susceptible to SQL injection attacks.
Vulnerability Detail
The vulnerability arises from the way the translation grid processes user-supplied JSON filter parameters. When a filter of type 'date' is used, the 'property' field is directly interpolated into a SQL expression without proper sanitization or parameterization. This allows an authenticated user with translation view permissions to manipulate the SQL query, potentially extracting sensitive data from the database through techniques such as UNION-based or error-based SQL injection. The inadequate sanitization method employed (str_replace to remove '--') is easily bypassable, leading to severe security implications.
How To Fix
Minimum fixed version
2.3.6
This is the first release that contains the fix.
composer require pimcore/admin-ui-classic-bundle:2.3.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the date filter functionality until the package is updated. This will prevent any potential exploitation of the SQL injection vulnerability while a permanent fix is being implemented.
Conclusion
The SQL injection vulnerability in the Pimcore Admin Classic Bundle's translation grid date filter poses a significant risk to applications using this package. By updating to the patched version and implementing proper validation measures, users can protect their systems from potential exploitation.
See every vulnerability recorded for pimcore/admin-ui-classic-bundle →
FAQ
CVE-2026-44741 is a security vulnerability in the Pimcore Admin Classic Bundle that allows for SQL injection through the translation grid date filter.
Authenticated users with translation view permissions in applications using vulnerable versions of the Pimcore Admin Classic Bundle are at risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 8.8, indicating a high severity level.
Update the Pimcore Admin Classic Bundle to version 2.3.6 or later and implement proper input validation for SQL queries to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for pimcore/admin-ui-classic-bundle.
