high7.0
CVE-2026-5394
An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger un…
Impact
An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger unintended SQL execution in the backend. This issue affects pimcore: 12.3.3.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | pimcore/pimcore | >= 12.0.0-RC1, <= 12.3.6 | 12.3.7 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-r2f4-ff2p-xc64
- https://github.com/pimcore/pimcore/security/advisories/GHSA-r2f4-ff2p-xc64
- https://nvd.nist.gov/vuln/detail/CVE-2026-5394
- https://github.com/pimcore/pimcore/pull/19108
- https://github.com/pimcore/pimcore/commit/6df625ff74015dc11f4bbe76170ce45bbd5dd61d
- https://fluidattacks.com/es/advisories/dragons
- https://github.com/pimcore/pimcore/releases/tag/v12.3.7
- https://github.com/pimcore/pimcore