SQL injection in Pimcore - CVE-2026-55072
Published: June 15, 2026 / Updated: September 15, 2026
Vulnerability identifier: #VU134523
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-55072
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to SQL injection in Block.php when loading a data object of a class with a crafted UID. A remote user can create a class definition with a malicious UID and trigger object loading to disclose sensitive information.
Exploitation requires the objects permission and access to the vulnerable class definition creation endpoint.
Affected software
Pimcore
How to mitigate CVE-2026-55072
Install security update from vendor's website.
Pimcore - addressed in versions 11.5.18, 12.3.9, 2026.1.5