Vulnerability · Published Feb 24, 2026 · Assigned by GitHub_M
CVE-2026-27461Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause
Medium 6.9
In plain English
A medium-severity SQL injection in pimcore from pimcore. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Pimcore is an Open Source Data & Experience Management Platform. In versions up to and including 11.5.14.1 and 12.3.2, the filter query parameter in the dependency listing endpoints is JSON-decoded and the value field is concatenated directly into RLIKE clauses without sanitization or parameterized queries. Exploiting this issue requires admin authentication. An attacker with admin panel access can extract the full database including password hashes of other admin users. Version 12.3.3 contains a patch.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | pimcore/pimcore | no fix listed | GHSA-vxg3-v4p6-f3fp |
| Packagist | pimcore/pimcore | 12.3.3 | GHSA-vxg3-v4p6-f3fp |
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/pimcore/pimcore/security/advisories/GHSA-vxg3-v4p6-f3fp x_refsource_CONFIRM
- https://github.com/pimcore/pimcore/pull/18991 x_refsource_MISC
- https://github.com/pimcore/pimcore/commit/1c3925fbec4895abeb21e5c244a83679c4e4a6f4 x_refsource_MISC
- https://github.com/pimcore/pimcore/releases/tag/v12.3.3 x_refsource_MISC