When this class is subsequently instantiated and accessed via a 'Block' field, the Block.php component concatenates the raw, unquoted classId directly into SQL queries. This allows an attacker to break out of the intended query context and execute arbitrary SQL commands. An attacker can leverage this to exfiltrate sensitive data, including password hashes from the users table, by performing a UNION-based SQL injection attack.

Attack Chain

1. Attacker authenticates to the Pimcore Studio API with valid 'objects' level credentials.
2. Attacker invokes the create action on the ClassDefinition configuration endpoint.
3. Attacker submits a specially crafted uid parameter containing a SQL payload (e.g., 1 UNION SELECT...).
4. The application processes the uid using an insufficiently anchored regex, which passes validation.
5. The attacker creates a new data object associated with this malicious class definition.
6. Attacker requests the data object via the API, triggering Block.php to load field data.
7. Block.php performs an unquoted string concatenation of the classId into a database query.
8. The underlying database executes the injected payload, returning sensitive table contents in the API response.

Impact

Successful exploitation allows an authenticated editor-level user to perform arbitrary SQL queries against the application database. This enables unauthorized exfiltration of sensitive information, including user credentials and configuration data. The impact is significant as it requires only standard editor permissions, facilitating privilege escalation via credential access.

Recommendation

1. Upgrade to a patched version of Pimcore that addresses CVE-2026-55072 immediately.
2. Audit existing ClassDefinition entries for UIDs containing non-alphanumeric characters or suspicious SQL keywords.
3. Deploy the Sigma rules below to monitor for suspicious POST requests to the ClassDefinition creation and data object retrieval endpoints.
4. Ensure database users operate with the principle of least privilege, specifically restricting access to sensitive tables like users from the web application user.

Attack Chain

1. An attacker authenticates as an administrative user with privileges to manage DataObject class definitions.
2. The attacker crafts a malicious JSON payload containing a compositeIndices section.
3. Within the compositeIndices section, the attacker injects SQL code into the index_columns field. For example: "slider), DROP COLUMN \oo_className` -- "`
4. The attacker imports the crafted JSON payload via the /pimcore-studio/api/class/definition/configuration-view/detail/1/import endpoint or saves the class definition through the administrative workflow.
5. importClassDefinitionFromJson() decodes the attacker-controlled JSON and forwards compositeIndices to setCompositeIndices().
6. setCompositeIndices() stores the values without sanitizing identifier content.
7. ClassDefinition::save() reaches ClassDefinition\Dao::update() which then calls updateCompositeIndices() on tables like object_store_<classId> and object_query_<classId>.
8. The injected SQL code is concatenated into an ALTER TABLE statement, which is then executed against the Pimcore database via Doctrine DBAL, leading to unintended schema modifications.

Impact

The SQL injection vulnerability allows a privileged attacker to alter backend SQL behavior during class-definition import/save, resulting in schema modification on Pimcore object tables. This can lead to unauthorized schema changes, backend denial of service by breaking expected table layouts, and data integrity issues for DataObject storage and queries. Versions up to and including v12.3.6 are vulnerable.

Recommendation

• Deploy the Sigma rule "Detect Pimcore SQL Injection via Composite Index Manipulation" to your SIEM and tune for your environment to detect exploitation attempts (rules).
• Apply input validation and sanitization to the index_columns field in Pimcore\Model\DataObject\ClassDefinition::setCompositeIndices() to prevent SQL injection (code).
• Upgrade Pimcore to a patched version that addresses CVE-2026-5394 when available.
• Monitor web server logs for POST requests to /pimcore-studio/api/class/definition/configuration-view/detail/*/import with suspicious characters in the compositeIndices parameter (logs).

Attack Chain

1. An unauthenticated attacker identifies two existing asset paths in the same directory on a Pimcore instance (e.g., /products/source.jpg and /products/existing.jpg).
2. The attacker crafts a WebDAV MOVE request targeting the source asset (/products/source.jpg).
3. The Destination header of the MOVE request is set to the path of the destination asset (/products/existing.jpg).
4. The Overwrite header is set to T, indicating that the destination asset should be overwritten if it exists.
5. The attacker sends the crafted MOVE request to the /asset/webdav endpoint.
6. The Pimcore server receives the request and, due to the missing authentication plugin, processes it without verifying the attacker's identity.
7. The Tree::move() function is executed, which deletes the source asset (/products/source.jpg) via the Asset::delete() function before checking for a valid user session or asset permissions.
8. The server attempts to set the userModification field but fails because there's no authenticated user, triggering an error. Despite the error, the source asset has already been deleted.

Impact

This vulnerability allows for the unauthorized deletion of assets in Pimcore. An unauthenticated attacker can remotely delete assets if they know the paths. In Pimcore deployments where assets represent product images, documents, media, or DAM-managed business content, this deletion or unauthorized overwrite can cause data loss, content integrity loss, and service disruption. The affected package is composer/pimcore/pimcore in versions 12.3.6 and earlier.

Recommendation

• Apply the necessary patches to upgrade Pimcore to a version greater than 12.3.6 to address CVE-2026-45260.
• Deploy the Sigma rule "Detect Pimcore WebDAV Unauthorized Asset MOVE" to identify potential exploitation attempts against the /asset/webdav endpoint.
• Monitor web server logs for MOVE requests targeting the /asset/webdav endpoint as described in the attack chain.

Attack Chain

1. The attacker identifies a writable data source, such as the tmp_store table or the webdav-delete.dat file.
2. The attacker gains write access to the chosen data source, for example via SQL injection against the tmp_store table or a file write vulnerability against webdav-delete.dat.
3. The attacker crafts a malicious serialized PHP object, containing a gadget chain designed for remote code execution (e.g., using Monolog's BufferHandler).
4. The attacker writes the malicious serialized data to the targeted data source (e.g., inserting a row into tmp_store with the serialized payload, or writing to webdav-delete.dat).
5. A user action or scheduled task triggers the vulnerable unserialize() call in one of the affected files (e.g., accessing a page that reads from TmpStore, or triggering a WebDAV operation that uses the delete log).
6. The PHP unserialize() function processes the attacker-controlled serialized data without allowed_classes.
7. The injected PHP object is instantiated, and its methods are invoked according to the gadget chain.
8. The gadget chain executes arbitrary PHP code with the privileges of the web server, resulting in remote code execution.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary PHP code on the Pimcore server. This can lead to complete compromise of the application, including data theft, modification, or deletion. The impact is amplified by the availability of public exploit techniques and gadget chains. Given Pimcore's use in content management and e-commerce, a successful attack could have significant financial and reputational consequences.

Recommendation

• Apply the vendor-supplied patch or upgrade to a version of Pimcore that addresses CVE-2026-45162.
• Deploy the Sigma rules provided in this brief to your SIEM and tune them for your environment to detect potential exploitation attempts.
• Monitor web server logs for suspicious activity related to database access (e.g., SQL injection attempts) that could be used to inject malicious serialized data into database tables.
• Implement strict file permission controls on the web server to prevent unauthorized writing to the filesystem, mitigating the risk of injecting serialized data into files like webdav-delete.dat.

Attack Chain

1. The attacker identifies a writable data source, such as the tmp_store table or the webdav-delete.dat file.
2. The attacker gains write access to the chosen data source, for example via SQL injection against the tmp_store table or a file write vulnerability against webdav-delete.dat.
3. The attacker crafts a malicious serialized PHP object, containing a gadget chain designed for remote code execution (e.g., using Monolog's BufferHandler).
4. The attacker writes the malicious serialized data to the targeted data source (e.g., inserting a row into tmp_store with the serialized payload, or writing to webdav-delete.dat).
5. A user action or scheduled task triggers the vulnerable unserialize() call in one of the affected files (e.g., accessing a page that reads from TmpStore, or triggering a WebDAV operation that uses the delete log).
6. The PHP unserialize() function processes the attacker-controlled serialized data without allowed_classes.
7. The injected PHP object is instantiated, and its methods are invoked according to the gadget chain.
8. The gadget chain executes arbitrary PHP code with the privileges of the web server, resulting in remote code execution.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary PHP code on the Pimcore server. This can lead to complete compromise of the application, including data theft, modification, or deletion. The impact is amplified by the availability of public exploit techniques and gadget chains. Given Pimcore's use in content management and e-commerce, a successful attack could have significant financial and reputational consequences.

Recommendation

• Apply the vendor-supplied patch or upgrade to a version of Pimcore that addresses CVE-2026-45162.
• Deploy the Sigma rules provided in this brief to your SIEM and tune them for your environment to detect potential exploitation attempts.
• Monitor web server logs for suspicious activity related to database access (e.g., SQL injection attempts) that could be used to inject malicious serialized data into database tables.
• Implement strict file permission controls on the web server to prevent unauthorized writing to the filesystem, mitigating the risk of injecting serialized data into files like webdav-delete.dat.