SB2026061537 - SQL injection in Pimcore

Description

This security bulletin contains information about 1 vulnerability.

1) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to SQL injection in Block.php when loading a data object of a class with a crafted UID. A remote user can create a class definition with a malicious UID and trigger object loading to disclose sensitive information.

Exploitation requires the objects permission and access to the vulnerable class definition creation endpoint.

Remediation

Install update from vendor's website.

References

• https://github.com/pimcore/pimcore/security/advisories/GHSA-2mhj-fhvg-v428
• https://github.com/pimcore/pimcore/commit/dbe1d131e4