CVE-2026-72562
Pimcore pimcore admin-ui-classic-bundle - SQL Injection
- State
- Published
- Severity
- 8.8 High
- Published
- Aug 11, 2026
- Updated
- Aug 11, 2026
- Reserved
- Aug 10, 2026
Description
An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause without parameterization. An attacker with backend access can exfiltrate or modify all database contents.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | TuranSec |
Weaknesses
- CWE-89 SQL Injection
Affected Products
| Product | Versions |
|---|---|
pimcore admin-ui-classic-bundlePimcore |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.