CVE-2026-44741

Executive Summary

CVE-2026-44741 is a high-severity SQL injection vulnerability (CVSS 8.8) affecting Pimcore's Admin Classic Bundle, a Backend UI component for the Pimcore digital experience platform. The flaw resides in the translation grid date filter, where user-supplied input from a JSON property field is interpolated directly into a UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...))) SQL expression without parameterization or allowlist validation. Affected versions prior to 2.3.6 and 1.7.18 expose authenticated users (those with access to the admin backend) to full database compromise. Successful exploitation yields complete confidentiality, integrity, and availability impact on the underlying database.

As of this report, the CVE has a patch confidence rating of 0/4 (unpatched), with no vendor advisory, no CISA KEV listing, and no public PoC evidence available. Enterprise environments running Pimcore Admin Classic Bundle versions below the fixed releases should treat this as an actively exploitable risk and prioritize remediation through version upgrades once the vendor releases official patches, or apply immediate compensating controls.

Technical Analysis

Vulnerability Mechanism

The vulnerability is a classic SQL injection (CWE-89) occurring in the translation grid date filter component of Pimcore's Admin Classic Bundle. According to the NVD description, the root cause is the direct interpolation of the user-supplied property field from the filter JSON into the following SQL expression:

UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...)))

The critical flaw is twofold:

1. Lack of parameterization — The property field is concatenated directly into the SQL string rather than passed as a bound parameter. This permits an attacker to break out of the intended expression context and append arbitrary SQL.
2. Lack of allowlist validation — No check is performed to confirm that the property value corresponds to an expected set of column or field names. This means an attacker can supply arbitrary syntax within the expression.

The presence of UNIX_TIMESTAMP, DATE, and FROM_UNIXTIME functions indicates the vulnerable expression is designed to convert a Unix epoch timestamp to a date boundary for SQL-level date filtering. The property field likely represents a column name or attribute that the filter should evaluate. Because this value is embedded inside nested function calls, the injection point allows the attacker to terminate the expression and concatenate additional SQL statements or clauses.

Attack Surface

• Authentication: PR:L — low privilege. An attacker must have authenticated access to the Pimcore admin backend (the Admin Classic Bundle serves the Backend UI). This reduces the attack surface to internal users, compromised credentials, or attackers who have already gained a foothold via other means.
• Network: AV:N — network accessible. The admin Backend UI is typically exposed on HTTP/HTTPS endpoints. In misconfigured environments where the admin UI is exposed to the internet, exploitation becomes remotely reachable.
• Complexity: AC:L — no special conditions or race conditions required. The vulnerable filter is a standard feature of the translation grid.
• Impact: C:H/I:H/A:H — complete database compromise. An attacker who successfully exploits this can read, modify, or delete arbitrary database content, potentially including credentials, user data, and application secrets.

The injection point is an HTTP request containing a JSON body with a property field. The exact endpoint is not disclosed in the NVD description; insufficient technical detail is available to identify the URL path. The vulnerable component is the translation grid, which implies the attack is triggered via a data-grid or listing request where filter JSON is posted to the backend.

Version Scope

• Affected: all versions of Pimcore's Admin Classic Bundle prior to 2.3.6 and 1.7.18.
• Fixed: versions 2.3.6 and 1.7.18.

The dual version range suggests two active branches (likely a 1.x maintenance line and a 2.x feature line), both of which are patched by their respective latest releases in the description.

Exploitation Scenarios

The attack chain below is inferred from the vulnerability class (SQL injection) and the description of the vulnerable component. No public PoC is available; details are described at the class level where the NVD description is sparse.

Step 1 — Reconnaissance and Target Identification

An attacker with low-level credentials (or a foothold on a compromised account) identifies that the target runs Pimcore with the Admin Classic Bundle. This can be determined by:

• Fingerprinting the backend UI during login requests.
• Observing the characteristic asset paths or response headers (specific endpoint paths not disclosed in the NVD data).
• Scanning for exposed admin panels via common paths and directories.

The attacker confirms access to the translation grid feature, which requires authentication to the admin Backend UI.

Step 2 — Triggering the Vulnerability

The attacker navigates to the translation grid view and submits a filter request containing a crafted JSON body. The request includes a property field that is expected to hold a column name for date-based filtering. Instead of a legitimate value, the attacker submits a malicious SQL payload.

The payload is embedded within the UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...))) expression. Because the property value is interpolated without sanitization, the attacker can:

• Close the current expression with a closing parenthesis.
• Append UNION SELECT to exfiltrate data from other tables.
• Append ; DROP TABLE or other data-destructive commands if stacked queries are permitted by the database configuration (commonly disabled in MySQL by default, so UNION/boolean-based blind injection is more likely).
• Use boolean-based or time-based blind injection to enumerate database contents when no error output is displayed.

Step 3 — Payload Execution

At the vulnerability-class level, the attacker's payload is an SQL injection targeting the filter expression. The malicious content bypasses the missing parameterization and allowlist checks. Example payload structures (not actual exploits, for illustrative purposes only):

• A UNION-based payload to append a select query that dumps credential hashes.
• A boolean-based payload that probes the database schema by altering the filter's truth conditions.
• A time-based payload using SLEEP() to confirm injection and enumerate data in absence of visible output.

The database response is returned within the translation grid's data output, or inferred via timing/error behavior.

Step 4 — Post-Exploitation Impact

On successful exploitation, the attacker achieves:

• Data exfiltration: Dumping all database tables, including user credentials, PIM asset metadata, customer data, and application configuration.
• Data integrity compromise: Modifying or deleting data, potentially disrupting the CMS-managed content and translated strings.
• Lateral movement: If the database credentials used by the application are reused elsewhere, or if the database server has outbound network access, the attacker may pivot.
• Potential code execution: In some configurations, database servers (e.g., MySQL with SELECT ... INTO OUTFILE) can write files to the host filesystem, leading to arbitrary code execution. This path is configuration-dependent and not guaranteed.

No public PoC is available; the attack chain is inferred from the vulnerability class and the description of the vulnerable component. The dual high integrity and availability impacts suggest the attacker can not only read data but also destroy or corrupt it, and potentially iterate toward full server compromise.

Impact Assessment

Business Impact

Pimcore is a digital experience platform used for enterprise-level content management, product information management (PIM), and digital asset management (DAM). The Admin Classic Bundle's translation grid is used by content administrators and localization teams. A successful SQL injection here yields:

• Confidentiality breach (C:H): Full database contents are readable. This includes user account credentials (potentially hashed), personally identifiable information (PII), customer data, and internal business records. Compliance obligations (GDPR, HIPAA, PCI-DSS) may be triggered, with legal and financial consequences.
• Integrity loss (I:H): An attacker can modify or delete arbitrary records. Content integrity is compromised; attackers could tamper with published content, alter pricing in catalogs, or corrupt the translation database.
• Availability impact (A:H): Direct deletion of critical tables or corruption of the database schema can lead to partial or complete unavailability of the Pimcore platform and dependent business systems.

Affected Systems and Blast Radius

• Directly affected: The Pimcore Admin Classic Bundle versions < 2.3.6 and < 1.7.18. Any enterprise running these versions with the translation grid in use.
• Indirectly affected: All consumers of Pimcore-hosted data — web portals, e-commerce sites, API consumers, and downstream reporting systems that depend on the database integrity.
• Blast radius: Database-level compromise extends beyond the translation grid; because the injection occurs in SQL executed against the underlying database, every table in the same database instance is at risk. Shared database servers (with multiple tenants) multiply the blast radius.

CVSS Rationale

• AV:N — Network-accessible via the admin UI's HTTP endpoint.
• AC:L — No special prerequisites beyond the vulnerable feature being reachable.
• PR:L — Requires an authenticated admin backend session, limiting exposure but not eliminating remote attacks given credential theft is common.
• UI:N — No user interaction needed.
• S:U — The compromised database is within the same security scope.
• C:H/I:H/A:H — Self-explanatory as above.

The score of 8.8 (High) is appropriate given the full-impact triad but the authentication requirement prevents a critical (9.0+) severity rating.

Detection Guidance

The following detection rules are generated based on the vulnerability mechanism described: an HTTP request to the Pimcore backend carrying a JSON property field containing SQL metacharacters, function calls, or obvious injection patterns targeting a date-filter expression. Note that these rules detect traffic patterns; they cannot detect injection attempts already obfuscated or encoded beyond basic patterns.

Sigma Rule

title: Pimcore Admin Classic Bundle SQL Injection Attempt - Translation Grid Date Filter
id: 6f4c9a2e-8b1d-4c3f-9a2e-1d5b7f8c9a2e
status: experimental
description: Detects HTTP requests to the Pimcore backend carrying a JSON "property" field with SQL injection patterns targeting the UNIX_TIMESTAMP/DATE/FROM_UNIXTIME expression.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-44741
author: Valtersit Threat Intelligence
date: 2026/01/01
logsource:
    category: webserver
    product: generic
detection:
    selection_method:
        cs-method: POST
    selection_path:
        cs-uri-query|contains:
            - 'admin'
            - 'translation'
            - 'grid'
    selection_body:
        cs-body|contains:
            - 'property'
            - 'UNIX_TIMESTAMP'
    selection_injection:
        cs-body|contains|all:
            - 'from'
            - 'union'
            - 'select'
        cs-body|contains|any:
            - '*/'
            - '--'
            - ';'
            - 'sleep('
            - 'benchmark('
    condition: selection_method and selection_path and selection_body and selection_injection
fields:
    - cs-host
    - c-ip
    - cs-username
    - cs-body
falsepositives:
    - Legitimate advanced date-filter queries with unusual column names (unlikely but possible)
    - POST requests with large JSON bodies where a column is legitimately named with SQL keywords
level: high

YARA Rule

rule CVE_2026_44741_Pimcore_SQLi_Body_Detection
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects HTTP request bodies containing SQL injection patterns targeting the Pimcore translation grid date filter."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-44741"
        cve = "CVE-2026-44741"
        date = "2026-01-01"
        severity = "high"

    strings:
        $s1 = "property" ascii wide nocase
        $s2 = "UNIX_TIMESTAMP" ascii wide nocase
        $s3 = "FROM_UNIXTIME" ascii wide nocase
        $s4 = "union select" ascii wide nocase
        $s5 = "union all select" ascii wide nocase
        $s6 = "sleep(" ascii wide nocase
        $s7 = "benchmark(" ascii wide nocase
        $s8 = "information_schema" ascii wide nocase
        $s9 = "/*" ascii wide
        $s10 = "--" ascii wide
        $s11 = ";" ascii wide

    condition:
        uint16(0) == 0x0a0d or uint16(0) == 0x0d0a or filesize < 1MB and
        (
            all of them
        ) and
        (
            ($s1 and $s2 and $s3) and
            (any of ($s4, $s5, $s6, $s7, $s8, $s9, $s10, $s11))
        )
}

Note: This rule is intended for network capture/pcap parsing where the HTTP body is extracted. In a raw HTTP stream, adjust for header/body separation.

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-44741 - Pimcore Admin Classic Bundle SQL Injection Attempt";
    flow:to_server,established;
    http.method;
    content:"POST";
    http.uri;
    content:"admin";
    nocase;
    http.client_body;
    content:"property";
    nocase;
    content:"UNIX_TIMESTAMP";
    nocase;
    pcre:"/union[\s]+all[\s]+select|union[\s]+select|sleep\s*\(|benchmark\s*\(|information_schema/i";
    classtype:web-application-attack;
    sid:202644741;
    rev:1;
    metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE-2026-44741;
)

Elastic Detection

POST /_search
{
  "query": {
    "bool": {
      "filter": [
        { "term": { "http.request.method": "POST" } }
      ],
      "must": [
        { "match": { "http.request.body.content": "property" } },
        { "match": { "http.request.body.content": "UNIX_TIMESTAMP" } },
        { "match": { "http.request.body.content": "FROM_UNIXTIME" } },
        { "regexp": { "http.request.body.content": ".*(union[[:space:]]+(all[[:space:]]+)?select|sleep[[:space:]]*\(|benchmark[[:space:]]*\(|information_schema).*" } }
      ],
      "should": [
        { "match": { "url.path": "translation" } },
        { "match": { "url.path": "grid" } }
      ],
      "minimum_should_match": 1
    }
  }
}

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis
| where method="POST"
| search body="*property*" AND body="*UNIX_TIMESTAMP*" AND body="*FROM_UNIXTIME*"
| regex body="(?i)(union[\s]+all[\s]+select|union[\s]+select|sleep\s*\(|benchmark\s*\(|information_schema|--|\/\*)"
| table _time, clientip, method, uri_path, body, status
| sort _time desc

Wazuh OSSEC Rule

<group name="pimcore, sql_injection, CVE-2026-44741,">
    <rule id="657482" level="12">
        <if_sid>31100</if_sid>
        <match>POST</match>
        <regex>property.*UNIX_TIMESTAMP.*FROM_UNIXTIME</regex>
        <regex>(?i)(union[\s]+all[\s]+select|union[\s]+select|sleep\s*\(|benchmark\s*\(|information_schema|--|\/\*)</regex>
        <description>CVE-2026-44741 - Pimcore Admin Classic Bundle SQL injection attempt detected in POST body</description>
        <group>pimcore_security,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Status

Patch confidence: 0/4 (UNPATCHED) — no patch evidence has been identified from any tracked source. The NVD description states versions 2.3.6 and 1.7.18 fix the issue, but no official vendor advisory or patch confirmation has been captured by our tracked sources at the time of this report. The affected versions list is empty in the intelligence data, and no vendor fix or workaround details are available.

Immediate actions are therefore compensating controls, not a verified patch.

1. Immediate Mitigations (Compensating Controls)

These do not fix the vulnerability, but reduce exploitability:

• Restrict network access: Place the Pimcore Admin Classic Bundle behind a VPN or bastion host. Do NOT expose the admin UI to the internet. Block external access via firewall rules.
• Enforce multi-factor authentication (MFA) on all admin backend accounts to reduce the risk of credential compromise that would grant the low-privilege access required.
• Web Application Firewall (WAF): Deploy a WAF rule to block POST requests to the admin translation grid endpoint containing SQL metacharacters (', ;, --, /*) in the JSON property field. Use the detection rules provided above as the basis for WAF signatures.
• Database least privilege: Ensure the application's database account has only the minimal privileges required (e.g., no FILE, DROP, or CREATE privileges). This limits the blast radius if injection succeeds.
• Activity monitoring: Enable detailed SQL audit logging in the database and monitor for anomalous queries targeting the translation grid's date-filter expression.

2. Patch / Upgrade Steps

• Upgrade to version 2.3.6 or 1.7.18 if your deployment is on the affected lines. These are the versions identified by the NVD description as containing the fix.
• Verify the upgrade path from your current version. If you are on a lower version (e.g., 2.3.5 or 1.7.17), review upgrade notes from the Pimcore project for breaking changes and testing requirements.
• After upgrading, confirm the vulnerable code path (the translation grid date filter) is present in the patched code — compare the filter implementation against the description of the fix (the fixed versions reference proper parameterization or allowlist validation).
• Subscribe to Pimcore security advisories to confirm patch availability and obtain the official fix reference when released.

3. Long-Term Hardening

• Security development lifecycle: Ensure the Pimcore project's fix is reviewed and that regression tests are added to the project's CI to prevent reintroduction of the flaw.
• Code review for similar patterns: Audit the codebase for other instances where user-supplied JSON fields may be interpolated into SQL expressions without parameterization. The same class of bug may exist in other grid filters.
• Parameterized queries mandate: Enforce a policy that all database queries use prepared statements or bound parameters; forbid direct string concatenation of user input into SQL.
• Input validation: Implement server-side allowlist validation for any field that maps to a database column name. The property field should be validated against a set of permitted column names.
• Authentication hardening: Rotate credentials for admin backend accounts following the security review. Conduct a user access audit.
• Incident response preparedness: Given the unpatched status, prepare an incident response playbook for database compromise. Run tabletop exercises and ensure backups are verifiable and restorable.

References

1. NVD Entry — CVE-2026-44741
   https://nvd.nist.gov/vuln/detail/CVE-2026-44741
   (Primary source: NVD description and CVSS vector)

2. Pimcore Admin Classic Bundle (official project)
   https://github.com/pimcore/admin-ui-classic-bundle (connection failed — verify manually)
   (Reference for project context; contains no fix details at the time of writing)

3. CWE-89 — SQL Injection (MITRE)
   https://cwe.mitre.org/data/definitions/89.html
   (Reference for vulnerability class mechanics and remediation patterns)

4. CISA Known Exploited Vulnerabilities Catalog
   https://www.cisa.gov/known-exploited-vulnerabilities-catalog
   (CVE-2026-44741 is NOT listed; check for updates as this may change)

Threat actor / exploit-in-the-wild evidence: None known at the time of this report. The CVE is not listed in CISA KEV, no PoC or exploit code is publicly available, and no Nuclei template exists. The attack chain described is inferred from the vulnerability class.