CVE-2026-55072

Executive Summary

CVE-2026-55072 is an authenticated SQL injection vulnerability in Pimcore, an Open Source Data & Experience Management Platform. A user holding the objects permission can store a malicious ClassDefinition UID that bypasses partial validation in models/DataObject/ClassDefinition.php, and when a data object of that class containing a Block field is loaded, Block::load inserts the stored class ID into an unquoted object table identifier, letting the UID supply SQL syntax. Successful exploitation allows reading or modifying arbitrary Pimcore database tables — including disclosure of password hashes — yielding high confidentiality impact and limited integrity impact (CVSS 8.5).

Technical Analysis

The vulnerability is an improper input validation flaw (CWE-20) that manifests as SQL injection through an unquoted identifier. Two code paths in Pimcore are involved and both are explicitly named in the description:

1. Validation defect — models/DataObject/ClassDefinition.php contains name and ID validation expressions that only validate the beginning of each value. The description states this is an "incomplete validation hardening because earlier work added a start anchor without enforcing the end of the identifier." In practice this means a regular expression such as one anchored at the start (^...) but lacking an end-of-string anchor ($) or equivalent full-string matching permits a value like valid_prefix<injected_tail> to pass validation, because only the leading portion must match the allowed pattern.

2. Sink defect — Block::load in models/DataObject/ClassDefinition/Data/Block.php takes the stored class ID and incorporates it into an unquoted object table identifier. SQL identifiers (table names) cannot be parameterized with standard prepared-statement placeholders, so any application that concatenates user-derived data into a table-name position is exposed to identifier injection. Because the identifier is unquoted, the stored UID can supply SQL syntax that is interpreted by the database engine rather than treated as an opaque name.

The attack requires authentication plus the objects permission — a non-trivial but common privilege level for content editors and back-office staff. Because the malicious value is stored in the ClassDefinition and later consumed when a data object of that class with a Block field is loaded, this is a second-order (stored) SQL injection: the payload is planted through one request and detonated by another. The CVSS vector correctly reflects the network attack vector, low attack complexity, low privileges required, no user interaction, and — critically — a Scope change (S:C), because the injected query escapes the intended object-table boundary and can reach arbitrary Pimcore database tables. Confidentiality is High (password hash disclosure, full table reads); Integrity is Low (the crafted query "can read or modify arbitrary Pimcore database tables," with modification impact bounded by the permissions of the database account).

Block fields (reusable content blocks in Pimcore data objects) are a common, legitimate modeling construct, which increases the likelihood that a targeted installation has at least one class with a Block field and therefore a reachable trigger path for the second-order payload.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template exists for this CVE. The attack chain below is inferred at the vulnerability-class level from the NVD description; no function names, parameters, or endpoints beyond those stated are asserted.

1. Reconnaissance / target identification. The attacker identifies a Pimcore installation and obtains valid credentials for an account granted the objects permission — via a legitimate editorial account, credential reuse, or prior compromise. The attacker enumerates class definitions and notes any class that includes a Block field, since that class type is the trigger for the vulnerable Block::load code path.

2. Trigger of the flaw class. With the objects permission, the attacker submits a crafted ClassDefinition UID whose value begins with a syntactically acceptable prefix (satisfying the partial, start-anchored validation in models/DataObject/ClassDefinition.php) but whose tail contains SQL syntax. Because validation only checks the beginning of the value, the malicious tail is persisted.

3. Payload execution (vulnerability-class level). When a data object of that class containing a Block field is loaded, Block::load interpolates the stored class ID into an unquoted table identifier in the generated query. The injected SQL tail is therefore parsed as query syntax instead of a table name, producing identifier/SQL injection. The attacker does not need a separate exploit primitive: the normal load path of the crafted class is what detonates the payload.

4. Post-exploitation impact. Per the description, the resulting query "can read or modify arbitrary Pimcore database tables, including disclosure of password hashes." Practical outcomes consistent with the description include exfiltration of credential material (enabling lateral movement or offline cracking of password hashes), bulk read of other tenants' or users' data housed in the same database, and integrity manipulation of Pimcore tables. The Scope-change rating (S:C) reflects that the attacker reaches well beyond the intended object table.

Impact Assessment

• Confidentiality: High. The injected query can read arbitrary Pimcore database tables and specifically discloses password hashes, which materially escalates risk (offline cracking, credential stuffing, privilege escalation).
• Integrity: Low. The description confirms the query "can ... modify arbitrary Pimcore database tables." The Low rating reflects bounded write impact rather than absence of write capability.
• Availability: None (A:N). No denial-of-service impact is described.
• Blast radius. Every Pimcore deployment prior to 2026.1.5 that grants the objects permission to any non-administrative user is in scope. Because the payload is stored in a class definition, a single injection can affect any subsequent load of objects of that class — a persistent, repeatable foothold rather than a one-shot event.
• Business impact. Pimcore is typically a customer-facing CMS/DXP and PIM. Compromise can expose customer records, product data, and admin password material; integrity tampering can corrupt published content or catalog data, with reputational and compliance consequences (GDPR/CCPA exposure from hash and record disclosure).

Detection Guidance

Sigma Rule

title: Potential Pimcore ClassDefinition UID SQL Injection (CVE-2026-55072)
id: 8f3c2b91-4d7e-4a02-9c11-pimcore55072
status: experimental
description: Detects SQL metacharacters in requests manipulating Pimcore ClassDefinition UID
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-55072
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-query|contains:
      - 'class-definition'
      - 'ClassDefinition'
      - 'pimcore'
  selection_payload:
    cs-uri-query|contains:
      - '%27'
      - '--'
      - 'UNION'
      - 'SELECT'
      - 'information_schema'
      - '0x'
  condition: selection_path and selection_payload
falsepositives:
  - Legitimate administrative activity with encoded characters
level: high

YARA Rule

rule CVE_2026_55072_Pimcore_ClassDef_SQLi
{
    meta:
        author = "valtersit.com"
        description = "Detects SQL metacharacters in stored Pimcore ClassDefinition UID values"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-55072"
        date = "2026-01-01"
    strings:
        $sqli = /(union[\s\/\*]+select|information_schema|sleep\(|benchmark\(|0x[0-9a-f]{4,})/ nocase
        $table = "definition_" nocase
    condition:
        $table and #sqli > 0
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-55072 Pimcore ClassDefinition UID SQL Injection Attempt"; flow:established,to_server; http.uri; content:"class-definition"; nocase; http.uri; content:"union"; nocase; http.uri; content:"select"; nocase; classtype:web-application-attack; reference:cve,2026-55072; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-55072; sid:202655072; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [http where http.request.method == "POST" and url.path contains "class-definition"]
  [http where url.path contains "class-definition" and
     (url.query contains "union" or url.query contains "select" or url.query contains "'")]

Splunk SPL Query

index=web OR index=proxy
| eval uri = coalesce(uri_query, url, cs_uri_query)
| where like(uri, "%class-definition%") OR like(uri, "%ClassDefinition%")
| where match(uri, "(?i)(union[\s\+]+select|information_schema|sleep\(|%27|--|\bselect\b.*\bfrom\b)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,pimcore,sqli,">
  <rule id="2026550" level="12">
    <if_sid>31100</if_sid>
    <match>class-definition</match>
    <regex>(?i)(union\s+select|information_schema|sleep\(|benchmark\(|%27)</regex>
    <description>CVE-2026-55072: Pimcore ClassDefinition UID SQL injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_55072,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists in any tracked source. The CNA text states the issue is fixed in 2026.1.5, but no vendor advisory, commit, or release artifact is currently tracked; treat this as the target version for planning only.

1. Immediate mitigations
   • Remove or tightly restrict the objects permission; do not grant it to untrusted or broadly shared accounts.
   • Audit existing ClassDefinition UID values for SQL metacharacters (quotes, comment markers, UNION/SELECT, hex literals) and reject/sanitize any that do not conform to a strict, fully anchored allowlist (both start and end of the identifier).
   • Run Pimcore against a least-privilege database account; revoke DDL/DML on tables outside the application's intended scope to blunt the "modify arbitrary tables" capability.
   • Apply WAF rules (e.g., the Suricata/Sigma logic above) to block SQL metacharacters in ClassDefinition-related requests, as a compensating control.
2. Patch / upgrade steps
   • Upgrade to Pimcore 2026.1.5 or later, where the validation is described as fixed. Verify the release artifact and hash before deployment; validate the fix by confirming the identifier validation enforces end-of-string anchoring.
   • Where a code-level fix must be backported, ensure both the validation expression in models/DataObject/ClassDefinition.php is end-anchored and the identifier in Block::load (models/DataObject/ClassDefinition/Data/Block.php) is properly quoted or allowlist-restricted.
3. Long-term hardening
   • Never interpolate user-derived data into unquoted SQL identifiers; use strict allowlisting for identifier positions.
   • Adopt anchored, full-string validation on all security-relevant fields, and add regression tests that specifically cover tail-injection bypasses of start-anchored regexes.
   • Rotate database credentials and force a password reset if hash disclosure is suspected.
   • Monitor for second-order injection by logging and alerting on class-definition changes followed by object loads.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-55072
• Pimcore project: https://pimcore.com/ (target fixed version 2026.1.5 per CNA description)
• CWE-20 Improper Input Validation: https://cwe.mitre.org/data/definitions/20.html
• MITRE ATT&CK T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA KEV: Not listed — no evidence of active exploitation in the wild. No public PoC, exploit code, or Nuclei template is available at the time of writing; EPSS 0.00372 (30.7th percentile) indicates low predicted exploitation likelihood. No known threat actor campaigns are associated with this CVE.