SQL Injection in Pimcore via ClassDefinition UID

Pimcore versions 2026.1.0 through 2026.1.4 and versions prior to 12.3.9 are vulnerable to SQL injection (CVE-2026-55072). The vulnerability stems from an incomplete fix regarding input validation of ClassDefinition UIDs. The regex used to validate the UID lacks an end anchor ($), allowing a user with 'objects' permissions to supply a string that starts with a valid character but contains additional malicious SQL.

When this class is subsequently instantiated and accessed via a 'Block' field, the Block.php component concatenates the raw, unquoted classId directly into SQL queries. This allows an attacker to break out of the intended query context and execute arbitrary SQL commands. An attacker can leverage this to exfiltrate sensitive data, including password hashes from the users table, by performing a UNION-based SQL injection attack.

Attack Chain

1. Attacker authenticates to the Pimcore Studio API with valid 'objects' level credentials.
2. Attacker invokes the create action on the ClassDefinition configuration endpoint.
3. Attacker submits a specially crafted uid parameter containing a SQL payload (e.g., 1 UNION SELECT...).
4. The application processes the uid using an insufficiently anchored regex, which passes validation.
5. The attacker creates a new data object associated with this malicious class definition.
6. Attacker requests the data object via the API, triggering Block.php to load field data.
7. Block.php performs an unquoted string concatenation of the classId into a database query.
8. The underlying database executes the injected payload, returning sensitive table contents in the API response.

Impact

Successful exploitation allows an authenticated editor-level user to perform arbitrary SQL queries against the application database. This enables unauthorized exfiltration of sensitive information, including user credentials and configuration data. The impact is significant as it requires only standard editor permissions, facilitating privilege escalation via credential access.

Recommendation

1. Upgrade to a patched version of Pimcore that addresses CVE-2026-55072 immediately.
2. Audit existing ClassDefinition entries for UIDs containing non-alphanumeric characters or suspicious SQL keywords.
3. Deploy the Sigma rules below to monitor for suspicious POST requests to the ClassDefinition creation and data object retrieval endpoints.
4. Ensure database users operate with the principle of least privilege, specifically restricting access to sensitive tables like users from the web application user.