CVE-2026-55072: Pimcore SQL Injection via ClassDefinition UID Regex Flaw
Summary
CVE-2026-55072: A missing end anchor ($) in the ClassDefinition UID validation regex allows an authenticated user with the objects permission to create a class with a malicious UID containing SQL. Affects pimcore/pimcore across 2 version ranges.
< 12.3.9
>= 2026.1.0, < 2026.1.5
Fixed in 12.3.9 or 2026.1.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pimcore is an open-source digital experience platform that enables users to manage and deliver content across various channels. It provides functionalities for content management, e-commerce, and digital asset management. The platform allows users to define classes for data objects, which can be manipulated through a user-friendly interface. However, a vulnerability exists in the ClassDefinition UID validation, which can lead to SQL injection attacks, compromising the integrity and confidentiality of the database.
Vulnerability Detail
The vulnerability arises from a missing end anchor in the regex used for validating ClassDefinition UIDs in Pimcore. This flaw allows an authenticated user with the 'objects' permission to create a class with a malicious UID containing SQL code. When a data object of this class is loaded, the Block.php file concatenates the raw classId directly into a SQL query without proper quoting, leading to the execution of the injected SQL payload. This vulnerability can result in unauthorized access to sensitive data, including user passwords, through SQL injection attacks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 12.3.912.3.9composer require pimcore/pimcore:12.3.9 -
>= 2026.1.0, < 2026.1.52026.1.5composer require pimcore/pimcore:2026.1.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can manually modify the regex patterns in the ClassDefinition.php file to include a trailing '$' anchor. Update the following lines:
if (!preg_match('/^[a-zA-Z]\w+$/', $this->getName())) {
if (!preg_match('/^[a-zA-Z0-9]([a-zA-Z0-9_]+)?$/', $this->getId())) {
Also, wrap the $object->getClassId() in $db->quoteIdentifier() in Block.php to ensure proper quoting.
Conclusion
CVE-2026-55072 represents a significant security risk for Pimcore users, allowing SQL injection through flawed UID validation. It is crucial to update to the patched version or implement workarounds to mitigate this vulnerability and protect sensitive data.
See every vulnerability recorded for pimcore/pimcore →
FAQ
CVE-2026-55072 is a vulnerability in Pimcore that allows SQL injection through improperly validated ClassDefinition UIDs.
Any authenticated user with 'objects' permission in Pimcore can exploit this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.5, indicating a high severity level.
If you cannot update, implement the recommended workaround by modifying the regex patterns and ensuring proper quoting in SQL queries.
References
Related vulnerabilities
Recent vulnerabilities recorded for pimcore/pimcore.
