CVE-2026-5394: SQL Injection Vulnerability in Pimcore Package
Summary
CVE-2026-5394: Pimcore admin users can trigger SQL Injection. Affects pimcore/pimcore versions 12.3.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pimcore is an open-source digital experience platform that enables users to manage digital assets, product information, and content. It is widely used for building websites, e-commerce platforms, and applications. The platform allows administrative users to import and save DataObject class definitions, which is a powerful feature but also introduces potential security risks if not properly managed.
Vulnerability Detail
The vulnerability arises from an SQL injection flaw that can be exploited by authenticated administrative users who have the ability to import or save DataObject class definitions. By injecting attacker-controlled composite index metadata, these users can trigger unintended SQL execution in the backend, potentially leading to unauthorized data access or manipulation. This vulnerability is classified under CWE-89, indicating its nature as an SQL injection issue.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, limit the permissions of administrative users to prevent them from importing or saving DataObject class definitions until the package is updated. This can help mitigate the risk of exploitation until a patch is applied.
Conclusion
CVE-2026-5394 represents a significant SQL injection vulnerability in the Pimcore package that can be exploited by administrative users. It is crucial to update to the patched version to mitigate the risks associated with this vulnerability. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for pimcore/pimcore →
FAQ
CVE-2026-5394 is a security vulnerability in the Pimcore package that allows authenticated administrative users to perform SQL injection attacks.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without any signup.
If exploited, this vulnerability could allow attackers to execute arbitrary SQL commands, leading to unauthorized access to sensitive data or manipulation of the database.
Yes, a patch is available in version 12.3.4 of the Pimcore package. It is recommended to update to this version or later.
The CVSS score of this vulnerability is 7.0, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for pimcore/pimcore.
