CVE-2026-55634

Executive Summary

CVE-2026-55634 is a critical (CVSS 9.9) vulnerability in Pimcore, an open-source Data & Experience Management Platform. The flaw resides in the class-definition import functionality, where an authenticated user possessing the objects permission can inject PHP syntax into generated DataObject class files, leading to remote code execution (RCE) when those classes are instantiated. Additionally, the same malformed input permits SQL injection into schema-changing ALTER TABLE statements. The issue affects all Pimcore versions prior to 11.5.19, 12.3.10, and 2026.1.6, with a patch claimed by a single source (NVD) though not independently confirmed.

Technical Analysis

The vulnerability exists in the class-definition import endpoint at /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import. When a user imports a class definition, the DataObject field name supplied by the importer is processed without passing through an identifier allowlist in two code paths:

1. PHP Code Generation: The file lib/DataObject/ClassBuilder/FieldDefinitionPropertiesBuilder.php emits the field name directly into generated PHP property definitions. Because the central validation method models/DataObject/ClassDefinition/Data.php::setName() fails to reject semicolons, braces, backticks, spaces, and other non-identifier characters, a crafted field name can break out of the intended property declaration syntax and inject arbitrary PHP code. The generated code is written to var/classes/DataObject/*.php files.

2. SQL Schema Statements: The file models/DataObject/ClassDefinition/Helper/Dao.php uses the same unsanitized field name in ALTER TABLE identifiers. An attacker-supplied field name containing backticks, semicolons, or metacharacters can alter the structure of the SQL statement, enabling SQL injection into schema-changing operations.

The vulnerability class is a combination of code injection via unsafe deserialization/import and SQL injection (CWE-89). The root cause is insufficient input validation on the DataObject field name across multiple sink points (PHP file generation and SQL statement construction). The impact is amplified by the fact that the injected PHP code persists in generated files and executes each time an object of that class is loaded, giving the attacker a persistent code execution primitive.

Exploitation Scenarios

Note: No public PoC is available; the attack chain is inferred strictly from the vulnerability description.

Step 1 — Reconnaissance / Target Identification: The attacker requires a Pimcore instance with an administrative or privileged user account that has the objects permission. This could be obtained via credential theft, phishing, brute force, or leveraging a separate lower-severity vulnerability. The attacker identifies the target instance and confirms the affected version range (pre-11.5.19, pre-12.3.10, pre-2026.1.6).

Step 2 — Triggering the Flaw: The attacker authenticates to the Pimcore Studio interface and navigates to the class-definition import feature, invoking the endpoint /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import. They submit a crafted class definition containing a malicious DataObject field name that includes PHP metacharacters (e.g., ;, {, (, )) or SQL metacharacters (e.g., backticks, semicolons) that bypass the Data.php::setName() validation.

Step 3 — Payload / Execution Method: The malicious field name is processed by FieldDefinitionPropertiesBuilder.php, which emits it into a PHP property declaration in a generated class file under var/classes/DataObject/. If the field name is crafted as validName; system('id'); /*, the generated PHP file will contain injected executable statements. When Pimcore instantiates an object of that DataObject class (e.g., during a data listing, CRUD operation, or object retrieval), the injected PHP code executes with the privileges of the web server process. Simultaneously, the field name is passed to Dao.php, which constructs ALTER TABLE statements, allowing SQL injection to modify database schema, exfiltrate data, or trigger additional stored procedures.

Step 4 — Post-Exploitation Impact: With RCE as the web server user, the attacker can read/write files within the application context, pivot to the database server via the injected SQL, escalate privileges to the OS user running PHP (often www-data or a service account), and leverage Pimcore's file-handling capabilities to transition to full server compromise. Given the CVSS scope score of "C" (Changed), the compromise extends beyond the vulnerable component to the underlying hosting system.

Proof of Concept Intelligence

1. Exploitation Likelihood: While no public PoC exists, the vulnerability's mechanics are straightforward and the required input validation gap is well understood. Pimcore is a widely deployed platform, and authenticated RCE flaws historically attract PoC development within days to weeks of public disclosure. The attack requires only low-privilege authentication (PR:L), making it attractive to both opportunistic attackers and sophisticated threat actors.

2. Monitoring for Future Disclosure: Defenders should monitor the following for the first PoC signs:

   • Pimcore's official GitHub repository and security advisories.
   • Public exploit databases (Exploit-DB, Packet Storm, NVD references), Nmap NSE and Metasploit module repositories.
   • Research blogs and Twitter/X accounts of prominent PHP security researchers and Pimcore contributors.
   • Dark web and Telegram channels focused on web application exploitation and ransomware access brokers.
   • Nuclei templates and other automated scanner repositories, since the class-definition import endpoint provides a stable, fingerprintable URI for detection.

Impact Assessment

• CVSS Context: CVSS 3.1 base score 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The attack is network-exploitable (AV:N) with low attack complexity (AC:L), requiring only low-privilege access (PR:L) and no user interaction (UI:N). The scope is "Changed" (S:C), indicating the compromise extends to resources beyond the vulnerable component, and the confidentiality, integrity, and availability impacts are all "High" (C:H/I:H/A:H).
• Business Impact: Complete compromise of Pimcore-managed digital experience platforms — including e-commerce sites, customer portals, and content management systems. Attackers can steal customer PII, payment data, intellectual property, plant persistent backdoors, deface content, and use the compromised server as a pivot point into the internal network.
• Blast Radius: All Pimcore deployments running versions prior to 11.5.19, 12.3.10, and 2026.1.6. The var/classes/DataObject/*.php generation path means even deployments rejecting the SQL injection path remain vulnerable to the PHP injection vector. Enterprise environments with integrated CRM, CMS, and data management use cases face elevated regulatory and reputational risk.

Detection Guidance

Sigma Rule

title: Pimcore Class Definition Import - Suspicious Field Name Payload
id: e9b8c3d4-5f6a-4b7c-8d9e-0f1a2b3c4d5e
status: experimental
description: Detects requests to the Pimcore class-definition import endpoint containing suspicious PHP or SQL metacharacters in field name parameters.
logsource:
  category: webserver
  product: apache
  definition: Requires access logs or reverse proxy logs that include full URI and POST body.
detection:
  selection_endpoint:
    cs-method: 'POST'
    cs-uri-stem|contains:
      - '/pimcore-studio/api/class/definition/configuration-view/detail/'
      - '/import'
  selection_payload:
    cs-uri-query|contains:
      - 'php'
      - 'system('
      - 'exec('
      - 'eval('
      - '`'
      - ';'
      - '{'
      - '}'
      - 'ALTER TABLE'
  condition: selection_endpoint and selection_payload
  timeframe: 5m
level: high
falsepositives:
  - Legitimate Pimcore administrators using unusual but valid field names (unlikely given strict naming conventions).
  - IDs or class names containing benign but uncommon characters.
fields:
  - clientip
  - cs-uri-stem
  - cs-uri-query
tags:
  - attack.t1190
  - attack.t1505.003
  - cve.2026.55634

YARA Rule

rule Pimcore_CVE_2026_55634_ClassDef_Import
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects generated Pimcore DataObject PHP class files containing injected executable PHP from malicious field names"
        date = "2026-02-01"
        reference = "CVE-2026-55634"
        severity = "critical"
    strings:
        $php_open = "<?php"
        $class_def = "class Definition" ascii wide nocase
        $field_builder = "FieldDefinitionPropertiesBuilder" ascii wide nocase
        $bad_meta = /;\\s*(system|exec|shell_exec|passthru|eval|assert|preg_replace)\\s*\\(/ nocase
        $bad_brace = /\\$[a-zA-Z_]+;\\s*\\{/ nocase
        $sql_inject = /ALTER TABLE.*[`;]\\s*(DROP|DELETE|INSERT|UPDATE|SELECT)/ nocase
        $backticks = /[a-zA-Z_0-9]+`[a-zA-Z_0-9]+`/ ascii
    condition:
        filesize < 2MB and
        $php_open and
        $class_def and
        (1 of ($bad_meta, $bad_brace, $sql_inject, $backticks)) and
        ($field_builder or 1 of ($bad_meta, $bad_brace))
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Pimcore CVE-2026-55634 Class Definition Import PHP Code Injection Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/pimcore-studio/api/class/definition/configuration-view/detail/"; http_uri; content:"/import"; http_uri; pcre:"/(?:system|exec|shell_exec|passthru|eval|assert)\s*\(/Ui"; pcre:"/(?:[;{}\x60]|ALTER\s+TABLE)/i"; classtype:attempted-admin; sid:5563401; rev:1; metadata:created_at 2026-02-01, updated_at 2026-02-01, cve CVE-2026-55634;)

Elastic Detection

- id: eql_pimcore_cve_2026_55634
  name: Detect Pimcore Class Definition Import with Malicious Field Name
  language: eql
  type: query
  query: |
    any where event.category == "web" and process.name == "httpd" and
      url.path : "*pimcore-studio/api/class/definition/configuration-view/detail/*/import" and
      (request.body : "*system(*" or request.body : "*exec(*" or request.body : "*eval(*" or
       request.body : "*`*" or request.body : "*;*" or request.body : "*ALTER TABLE*" or
       request.body : "*{*")
  index:
    - filebeat-*
  risk_score: 75
  severity: high

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%pimcore-studio/api/class/definition/configuration-view/detail/%") 
  and like(uri_path, "%/import%")
| rex field=form_data "(?<fieldname>[^=&]+)="
| eval suspicious_payload = if(match(fieldname, "(?i)(system|exec|eval|passthru|assert)\s*\(") OR 
     match(fieldname, "[;`{}]") OR match(fieldname, "(?i)ALTER TABLE"), 1, 0)
| where suspicious_payload=1
| eval threat_score = 75
| table _time, src_ip, uri_path, http_method, fieldname, user_agent
| sort - _time

Wazuh OSSEC Rule

<group name="pimcore,">
  <rule id="100556" level="15" frequency="5" timeframe="60">
    <if_sid>31100</if_sid>
    <match>pimcore-studio/api/class/definition/configuration-view/detail/</match>
    <match>/import</match>
    <regex>((system|exec|eval|passthru|assert)\s*\(|[;`{}]|ALTER\s+TABLE)</regex>
    <description>Pimcore CVE-2026-55634: Class definition import with malicious field name - PHP code injection attempt</description>
    <mitre>
      <id>T1190</id>
      <id>T1505.003</id>
    </mitre>
    <group>pimcore,exploit,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate Mitigations (until patched):

   • Restrict access to the /pimcore-studio/api/class/definition/configuration-view/detail/*/import endpoint via web server ACLs or a WAF to only trusted administrative IP ranges.
   • Disable the import functionality by removing or denying access to the Pimcore\Bundle\StudioBackendBundle route if not actively used.
   • Enforce strict input validation at the WAF level, blocking POST requests containing PHP function names, semicolons, backticks, or braces in body parameters for the vulnerable endpoint.
   • Review var/classes/DataObject/*.php files for unexpected code injection via file integrity monitoring (e.g., AIDE, Tripwire, Wazuh FIM).

2. Patch / Upgrade Steps:

   • Upgrade Pimcore to version 11.5.19, 12.3.10, or 2026.1.6 (whichever matches the deployed major version line).
   • Verify the patch in a staging environment before production rollout.
   • Since patch confidence is only 2/4 (claimed but not independently confirmed), test class-definition import functionality post-upgrade with both benign and intentionally malicious field names to confirm the validation fix in Data.php::setName() behaves as expected.

3. Long-Term Hardening:

   • Apply the Principle of Least Privilege: ensure the objects permission is granted only to trusted operators, and implement RBAC to separate content editors from system administrators.
   • Segment Pimcore instances from the internal network; place them in a DMZ with outbound egress filtering to prevent multi-stage post-exploitation.
   • Implement runtime file integrity monitoring on var/classes/DataObject/ and alert on any modification outside of the official class-builder workflow.
   • Maintain an active CVE monitoring process for Pimcore; alerts should cover both NVD and the vendor's own advisory channels.
   • Periodically audit web logs for POST requests to the vulnerable endpoint and correlate with authentication logs to verify that only authorized users invoke import functionality.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-55634 — Official CVE record with CVSS vector 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
2. Pimcore Security Advisories: https://github.com/pimcore/pimcore/security/advisories — Vendor security advisory page; patch versions 11.5.19, 12.3.10, and 2026.1.6 referenced in the NVD description.
3. Pimcore GitHub Repository: https://github.com/pimcore/pimcore — Source for affected files (lib/DataObject/ClassBuilder/FieldDefinitionPropertiesBuilder.php, models/DataObject/ClassDefinition/Helper/Dao.php, models/DataObject/ClassDefinition/Data.php); monitor for commit history post-patch to validate fix quality.
4. CISA KEV: Not applicable — this CVE is not listed on the CISA Known Exploited Vulnerabilities catalog as of the report date.

Threat Actor Intelligence: No known threat actor campaigns or exploit-in-the-wild evidence have been reported for CVE-2026-55634 at the time of writing. The lack of a public PoC and Nuclei template does not preclude exploitation, as the vulnerability class (authenticated code injection via import) is well understood in the PHP ecosystem and likely within reach of moderately skilled attackers. Given the high CVSS of 9.9 and the prevalence of Pimcore in enterprise environments, defenders should treat this as a high-priority patch item and maintain active monitoring until patch confidence improves to independently confirmed (3/4) and PoC status is verified.