Pimcore Vulnerability: Remote Code Execution and SQL Injection Risk
- Severity
- CRITICAL
- Affected component
- pimcore (packagist)
- Affected versions
- >= 12.3.3, <= 12.3.3 or >= v12.3.3, <= v12.3.3
- Patched version
- Not yet available
Pimcore is under investigation for a critical vulnerability that reportedly allows remote code execution and SQL injection via unvalidated DataObject class-definition field names.
What happened
An early warning has been issued for a critical vulnerability in Pimcore, identified as CVE-2026-5394 and tracked under GHSA-9X44-4GXF-8C25. This vulnerability appears to enable authenticated users with 'objects' permission to execute arbitrary PHP code and ALTER TABLE DDL, potentially leading to full server compromise. The vulnerability affects Pimcore versions >= 12.3.3, <= 12.3.3 or >= v12.3.3, <= v12.3.3. There is no indication that this vulnerability has been exploited in the wild at this time.
The vulnerability stems from insufficient validation of DataObject class-definition field names, allowing malicious input to be executed as PHP code or SQL commands. This could enable an attacker to gain unauthorized access to the server and manipulate the database. The issue is compounded by the fact that the 'objects' permission, which is required to exploit this vulnerability, is commonly granted to users in many Pimcore installations.
What to do about it
- Upgrade to the latest version of Pimcore to mitigate the risk of this vulnerability.
- Review and restrict access controls for the 'objects' permission to limit the potential attack surface.
- Monitor the primary sources for updates on this vulnerability and any official patches that may be released.
- Consider implementing additional security measures such as web application firewalls and intrusion detection systems to detect and prevent potential exploitation attempts.
How 0Day would have caught this
pimcore is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if you are using Pimcore versions >= 12.3.3, <= 12.3.3 or >= v12.3.3, <= v12.3.3. Check your Pimcore version and consult the primary sources for the most up-to-date information.
What should I do right now?
Immediately upgrade to the latest version of Pimcore and review your access controls for the 'objects' permission. Monitor the primary sources for any updates or official patches.
Has this been exploited in the wild?
There is no confirmed report of this vulnerability being exploited in the wild at this time. However, it is under investigation and the situation may change.