CVE-2026-27461
Last modified
CVE-2026-27461 is a medium-severity vulnerability rated 4.9/10 on the CVSS scale. Pimcore is an Open Source Data & Experience Management Platform. In versions up to and including 11.5.14.1 and 12.3.2, the filter query parameter in the dependency listing endpoints is JSON-decoded and the value field is concatenated directly into RLIKE clauses without sanitization or parameterized queries. EPSS estimates a 0.46% chance of exploitation in the next 30 days.
Description
Pimcore is an Open Source Data & Experience Management Platform. In versions up to and including 11.5.14.1 and 12.3.2, the filter query parameter in the dependency listing endpoints is JSON-decoded and the value field is concatenated directly into RLIKE clauses without sanitization or parameterized queries. Exploiting this issue requires admin authentication. An attacker with admin panel access can extract the full database including password hashes of other admin users. Version 12.3.3 contains a patch.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Pimcore | Pimcore | <= 11.5.14.1 |
| Pimcore | Pimcore | >= 12.0.0, < 12.3.3 |
References
- https://github.com/pimcore/pimcore/pull/18991Issue Tracking, Patch
- https://github.com/pimcore/pimcore/releases/tag/v12.3.3Product, Release Notes
- https://github.com/pimcore/pimcore/security/advisories/GHSA-vxg3-v4p6-f3fpExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-27461?
How severe is CVE-2026-27461?
How do I fix CVE-2026-27461?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-27456util-linux is a random collection of Linux utilities. Prior …4.7
- CVE-2026-27457Weblate is a web based localization tool. Prior to version 5…4.3
- CVE-2026-27458LinkAce is a self-hosted archive to collect website links. V…5.4
- CVE-2026-27459pyOpenSSL is a Python wrapper around the OpenSSL library. St…9.8
- CVE-2026-2746SEPPmail Secure Email Gateway before version 15.0.1 does not…5.3
- CVE-2026-27460Tandoor Recipes is an application for managing recipes, plan…6.5
- CVE-2026-27464Metabase is an open-source data analytics platform. In versi…6.5
- CVE-2026-27465Fleet is open source device management software. In versions…6.5
- CVE-2026-27466BigBlueButton is an open-source virtual classroom. In versio…8.2
- CVE-2026-27467BigBlueButton is an open-source virtual classroom. In versio…2.4
- CVE-2026-27468Mastodon is a free, open-source social network server based …8.2
- CVE-2026-27469Isso is a lightweight commenting server written in Python an…6.1
Are you affected by CVE-2026-27461?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST