An authenticated SQL injection vulnerability in Pimcore allows attackers to compromise database integrity and confidentiality, warranting immediate attention.

The flaw arises from improper input validation in the ClassDefinition UID field within models/DataObject/ClassDefinition.php. An attacker with specific object permissions can inject malicious SQL syntax into the identifier, which is improperly sanitized during the loading process of Block fields in models/DataObject/ClassDefinition/Data/Block.php.

Successful exploitation allows an authenticated attacker to execute arbitrary SQL commands against the underlying database. This poses a severe risk to data confidentiality and integrity, potentially leading to the theft of sensitive information, such as password hashes, or unauthorized modification of system data. With a CVSS score of 8.5, this high severity flaw represents a significant risk to the Pimcore platform and its stored organizational data.

Immediate Action: Update the Pimcore installation to version 2026.1.5 or later to resolve the input validation flaw.

Proactive Monitoring: Audit database logs for unusual query patterns, particularly those involving unexpected characters or syntax within class definition identifiers.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules designed to detect and block common SQL injection patterns to reduce the likelihood of successful exploitation during the patching window.

Public Exploit Available: No

Given the potential for unauthorized data access and modification, organizations should prioritize upgrading to the patched version of Pimcore immediately. While the attack requires authenticated access, the risk remains high due to the potential for privilege escalation and the exposure of critical credentials within the database.