A critical vulnerability in Pimcore allows authenticated users to achieve remote code execution and SQL injection, posing a severe risk to data integrity and system control.

This vulnerability involves improper input validation in the class definition import process. An authenticated user with object permissions can inject malicious PHP syntax and SQL identifiers, leading to arbitrary code execution when generated class files are instantiated and unauthorized database schema modifications.

The potential for remote code execution grants an attacker full control over the application server, while SQL injection capabilities allow for the exfiltration or destruction of sensitive business data. Given the CVSS score of 9.9, this vulnerability represents a critical risk that could lead to complete system compromise, loss of intellectual property, and significant operational downtime.

Immediate Action: Update Pimcore to version 11.5.19, 12.3.10, 2026.1.6, or later, as these releases contain the necessary validation logic to prevent malicious injection.

Proactive Monitoring: Audit server logs for unexpected file creation in the var/classes/DataObject/ directory and monitor database logs for suspicious ALTER TABLE commands or anomalous schema modifications.

Compensating Controls: Implement strict role-based access control to limit which users have the objects permission and deploy a Web Application Firewall to inspect and block requests containing suspicious PHP or SQL syntax patterns targeting the import endpoint.

Public Exploit Available: Unknown

Organizations running affected versions of Pimcore must prioritize patching immediately to eliminate the risk of remote code execution. Given the critical severity and the existence of proof-of-concept evidence, delaying remediation significantly increases the risk of a successful, high-impact security breach.