CVE-2026-55072

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the beginning of each value. When a data object of that class containing a Block field is loaded, Block::load in models/DataObject/ClassDefinition/Data/Block.php incorporates the stored class ID into an unquoted object table identifier, allowing the UID to supply SQL syntax. The resulting query can read or modify arbitrary Pimcore database tables, including disclosure of password hashes, and the flaw represents an incomplete validation hardening because earlier work added a start anchor without enforcing the end of the identifier. This issue is fixed in version 2026.1.5.

• CWE-20
• CWE-89

• https://github.com/pimcore/pimcore/commit/33a0e1887e1e31b4283b016ac5440c35ea5697b4
• https://github.com/pimcore/pimcore/pull/19177
• https://github.com/pimcore/pimcore/releases/tag/v2026.1.5
• https://github.com/pimcore/pimcore/security/advisories/GHSA-2mhj-fhvg-v428
• https://github.com/pimcore/pimcore/security/advisories/GHSA-2mhj-fhvg-v428

Published

Sep 14, 2026

Last Modified

Sep 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55066Vikunja is an open-source self-hosted task management platfo…7.1
• CVE-2026-55067Vikunja is an open-source self-hosted task management platfo…5
• CVE-2026-55068free5GC is an open-source implementation of the 5G core netw…9.3
• CVE-2026-55069Kestra is an open-source, event-driven orchestration platfor…8.7
• CVE-2026-5507When restoring a session from cache, a pointer from the seri…4
• CVE-2026-55071MCP-for-Stata is a MCP server for integrating Stata into age…8.4
• CVE-2026-55073WeasyPrint helps web developers to create PDF documents. Pri…6.2
• CVE-2026-55074Ansible FreeBSD Jail Connection Plugin is an Ansible connect…8.2
• CVE-2026-55075Coder allows organizations to provision remote development e…7.4
• CVE-2026-55076Coder allows organizations to provision remote development e…7.4
• CVE-2026-55077Coder allows organizations to provision remote development e…7.2
• CVE-2026-55078Coder allows organizations to provision remote development e…6.5