CVE-2026-72562

Executive Summary

CVE-2026-72562 is an unpatched SQL injection vulnerability in the Pimcore admin-ui-classic-bundle through version 2.3, affecting authenticated backend users. The flaw exists within the DataObject grid's id column filter, where user-supplied filter values are concatenated directly into the SQL WHERE clause without parameterization, enabling an attacker with backend access to execute arbitrary SQL statements. Successful exploitation leads to complete confidentiality, integrity, and availability compromise of the underlying database, allowing exfiltration or modification of all stored data. With a CVSS score of 8.8 and no patch available, this vulnerability poses a significant risk to organizations running affected Pimcore versions.

Technical Analysis

The vulnerability resides in the Pimcore admin-ui-classic-bundle, specifically within the DataObject grid functionality. DataObject grids in Pimcore provide a customizable backend interface for managing objects stored in the database, allowing administrators to filter, sort, and display records based on column values. The affected mechanism is the grid's "id" column filter.

Vulnerability Class and Mechanism: This is a classic SQL injection vulnerability (CWE-89), stemming from the failure to use parameterized queries when processing filter input. The NVD description states that the filter value is "concatenated directly into the SQL WHERE clause without parameterization." This indicates that when a backend user applies a filter to the id column of a DataObject grid, the input string is embedded directly into a SQL query string at runtime.

Attack Surface and Preconditions: The vulnerability requires authentication as a backend user. Pimcore's admin backend is typically accessible via a dedicated URL (commonly /admin) and is exposed to authenticated users who manage content, assets, and DataObjects. The id column filter is a standard feature available to any user with backend access, meaning no special privileges beyond a valid backend account are required to reach the vulnerable code path.

Code-Level Explanation: While the NVD description does not provide specific function names or file paths, the vulnerability mechanism is clear: dynamic SQL query construction where user input is inserted without sanitization or binding parameters. In a typical implementation, a filter applied to a grid column would be processed through a query builder that appends conditions to a WHERE clause. Without parameterization, the query might resemble:

SELECT ... FROM objects WHERE id = [USER_INPUT]

If the input contains SQL metacharacters such as quotes, semicolons, or comment markers (', ;, --, #), the attacker can break out of the intended comparison and inject arbitrary SQL statements.

Rationale for Vulnerability: The id column is numeric in nature, but the application likely treats all filter inputs as strings. The developer either omitted input validation to confirm numeric type or failed to use bound parameters when constructing the query. This oversight directly contradicts secure coding practices for database interactions.

Blast Radius Within the Application: Because the injection occurs in the backend admin interface, an attacker who successfully exploits this flaw gains the same database privileges as the application itself. Pimcore applications typically connect to the database with elevated privileges, giving the attacker full read/write access to all application data.

Exploitation Scenarios

The attack chain for CVE-2026-72562 involves the following progression. No public exploit code has been released, and no PoC has been validated; the following attack chain is inferred from the vulnerability class and NVD description.

1. Reconnaissance / Target Identification: An attacker first identifies a Pimcore instance. Shodan can discover these via the login page title "Pimcore" or through the distinctive administrative interface. The attacker must obtain valid backend credentials through credential stuffing, phishing, or prior compromise of an employee account. Given that the vulnerability requires only low-privilege backend authentication (CVSS PR:L), a standard editor or data manager account is sufficient.

2. Vulnerability Trigger: Once authenticated, the attacker navigates to a DataObject listing view within the admin interface. The attacker selects the id column filter option and introduces malicious SQL syntax into the filter field. The application processes this input and concatenates it into the SQL WHERE clause without parameterization.

3. Payload Execution (Vulnerability-Class Level): At the vulnerability-class level, the attacker would inject SQL syntax that breaks out of the filter condition. For example, input such as 1 OR 1=1 would bypass filter conditions, while more advanced payloads using stacked queries or UNION SELECT statements could be employed to extract data or execute write operations. The exact syntax depends on the underlying database engine (MySQL, MariaDB, or PostgreSQL are common for Pimcore deployments). Without parameterization, the injected SQL is executed by the database with the application's privileges.

4. Post-Exploitation Impact: With SQL injection established, the attacker can:

• Exfiltrate data: Extract user credentials (including password hashes), customer information, financial records, and any other data stored in the database.
• Modify data: Alter object records, change user roles, inject malicious content, or tamper with application configuration.
• Escalate privileges: Modify backend user records to grant administrative access.
• Achieve RCE: Depending on database permissions and file system access, the attacker may be able to write files via INTO OUTFILE (MySQL) or COPY TO PROGRAM (PostgreSQL), potentially achieving remote code execution on the underlying server.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates that the attack is network-accessible, requires low attack complexity, requires low privileges, and results in complete compromise of confidentiality, integrity, and availability.

Impact Assessment

Business Impact: This vulnerability enables a complete database compromise for any authenticated backend user. The impact is compounded by the fact that credential theft, data tampering, and database-level persistence are immediately achievable. For organizations processing personal data, this could result in significant regulatory consequences under GDPR, CCPA, or other applicable data protection frameworks.

Affected Systems: All Pimcore instances running admin-ui-classic-bundle version 2.3 and earlier that expose the backend admin interface to authenticated users. Pimcore is widely used in e-commerce, digital experience platforms, and content management deployments, making this vulnerability relevant across numerous sectors.

Blast Radius: The CVSS subscores of C:H/I:H/A:H reflect total compromise of data confidentiality, data integrity, and system availability. The attacker can read every database record, alter or delete any data, and potentially disrupt database operations entirely, leading to a full denial of service for the application.

Lateral Movement Potential: Compromised database credentials and extracted application secrets can be leveraged for lateral movement within the organization's network, particularly if the application uses shared credential sets or if the database server is accessible from other network segments.

Risk Rating: The absence of a patch (Patch Confidence: 0/4) elevates this from a standard critical vulnerability to a strategic security concern. Organizations must implement compensating controls until a vendor fix is available.

Detection Guidance

Detecting exploitation of CVE-2026-72562 requires logging and monitoring of Pimcore backend traffic, database query patterns, and application-level access logs.

Sigma Rule

title: Pimcore DataObject Grid SQL Injection Attempt
id: 7f93d3b6-1a9c-4f2e-8d4b-5a1c9e3f2d8b
status: experimental
description: Detects SQL injection attempts against Pimcore admin-ui-classic-bundle DataObject grid id column filter
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-72562
author: Valters IT Cyber Threat Intelligence
date: 2026/01/15
logsource:
    category: web
    product: nginx
    definition: 'Web server logs capturing HTTP requests to Pimcore admin interface'
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'filterRules'
            - 'objectGrid'
        cs-uri-query|contains|all:
            - 'id'
            - '%27'
            - 'OR'
    selection2:
        cs-uri-query|contains:
            - 'union%20select'
            - 'select%20%2A'
            - 'sleep%2a'
            - '1%3d1'
    condition: selection and (selection2 or cs-uri-query|contains: '%27%20%2d%2d')
falsepositives:
    - Legitimate queries containing filter criteria with apostrophes (rare)
level: high
tags:
    - attack.t1190
    - cve.2026.72562
    - cwe.89

YARA Rule

rule Pimcore_DataObject_SQLi_CVE_2026_72562
{
    meta:
        author = "Valters IT Cyber Threat Intelligence"
        description = "Detects SQL injection payloads targeting Pimcore DataObject grid id column"
        reference = "CVE-2026-72562"
        date = "2026-01-15"
    strings:
        $s1 = "filterRules" ascii
        $s2 = "objectGrid" ascii
        $s3 = "grid" ascii
        $p1 = "' OR '1'='1" ascii
        $p2 = "OR 1=1" ascii
        $p3 = "UNION SELECT" ascii nocase
        $p4 = "union select" ascii
        $p5 = "sleep(" ascii nocase
        $p6 = "waitfor delay" ascii nocase
        $p7 = "'--" ascii
        $p8 = "';" ascii
        $p9 = "benchmark(" ascii
    condition:
        uint16(0) == 0x3C21 and // "<!"
        any of ($s*) and
        (any of ($p*) or #p2 > 4)
}

Suricata IDS Rule

alert http any any -> any any (msg:"Pimcore DataObject Grid SQL Injection Attempt (CVE-2026-72562)"; flow:established,to_server; content:"filterRules"; http_uri; content:"objectGrid"; http_uri; content:"id"; http_uri; pcre:"/(?:union\s+select|\x27\s*(?:OR|AND)\s+.*=.*|sleep\s*\(|benchmark\s*\()/iR"; classtype:web-application-attack; reference:cve,2026-72562; sid:2026121501; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where event.type in ("start", "connection") and 
   process.name == "httpd" or process.name == "nginx" or process.name == "php-fpm"]
  [http where event.action in ("request", "access") and
   url.path == "*pimcore*" and
   url.query contains "filterRules" and
   for uri in http.request.body.string:
     uri matches ".*objectGrid.*id.*(union select|' OR '1'='1|\x27 OR|\x27--|sleep\\\()"]

Splunk SPL Query

index=web sourcetype=access_combined
| where match(uri, "(?i)objectGrid.*filterRules")
| where match(uri, "(?i)id.*(union|select|\x27|OR|AND|--|sleep|benchmark|waitfor)")
| eval vuln_match = case(
    match(uri, "(?i)union\s+select"), "UNION-based SQLi",
    match(uri, "(?i)\x27\s*OR\s+1\s*=\s*1"), "Boolean-based SQLi",
    match(uri, "(?i)sleep\s*\("), "Time-based SQLi",
    match(uri, "(?i)benchmark\s*\("), "Time-based SQLi (MySQL)",
    true(), "Other SQLi pattern")
| table _time, src_ip, user, uri, status, vuln_match
| sort - _time

Wazuh OSSEC Rule

<group name="pimcore, sql_injection, cve_2026_72562,">
  <rule id="665360-01" level="12">
    <decoded_as>web</decoded_as>
    <match>filterRules</match>
    <match>objectGrid</match>
    <regex>\.*id\.*(union|select|'|\-\-|sleep|benchmark)</regex>
    <description>Potential SQL Injection attempt against Pimcore DataObject grid (CVE-2026-72562)</description>
    <group>cvss_88, attack_1190, cwe_89,</group>
    <mitre>
      <technique id="T1190">Exploit Public-Facing Application</technique>
    </mitre>
    <var name="alert_level">12</var>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: This vulnerability is unpatched (Patch Confidence: 0/4). No vendor advisory, official patch, or update has been released for this CVE. The affected version range (admin-ui-classic-bundle <= 2.3) currently has no known fixed version.

1. Immediate Mitigations (No Patch Available)

• Restrict Admin Access: Limit access to the Pimcore backend admin interface to only authorized users via IP allowlisting or VPN requirements. Implement strict network segmentation between the admin UI and internet-facing network segments.
• Enable Strong Authentication: Enforce multi-factor authentication (MFA) for all backend accounts to reduce the risk of credential compromise, which is the prerequisite for exploitation.
• Monitor Backend Activity: Increase logging and monitoring on the admin interface, particularly for DataObject grid operations. Apply the Sigma, Suricata, and Splunk detections provided above to alert on suspicious patterns.
• Database Permissions: Review the database privileges of the Pimcore application account. If possible, restrict the account to only necessary schemas/tables and revoke write or DDL privileges where feasible, limiting the impact of successful exploitation.
• Web Application Firewall (WAF): Deploy a WAF rule to block requests containing SQL injection patterns in filter parameters targeting the admin interface.

2. Patch / Upgrade Steps

• Vendor Monitoring: Monitor Pimcore's official security advisories and the GitHub repository for admin-ui-classic-bundle for patched releases. Subscribe to the Pimcore Security Advisory mailing list.
• Version Assessment: Conduct a full inventory of all Pimcore instances in your environment and confirm which are running admin-ui-classic-bundle version 2.3 or earlier. Prioritize patching based on exposure.
• Upgrade Plan: When a patched version becomes available, apply the upgrade in a staging environment before production deployment. Validate all custom plugins and extensions against the update.
• Vendor Communication: Contact Pimcore support to request an expedited timeline for the security fix and to verify whether any deployed configuration can neutralize the vulnerability without waiting for a full release.

3. Long-Term Hardening

• Secure Coding Practices: Enforce parameterized queries and prepared statements for all database interactions in Pimcore customizations and plugins. Adopt ORM frameworks that abstract SQL generation and inherently protect against injection.
• Routine Security Audit: Include Pimcore configuration and third-party bundle reviews in recurring security assessments. Check for any references to admin-ui-classic-bundle in your dependency manifest.
• Database Hardening: Run Pimcore database access under least-privilege principles. Separate application accounts for read-only and write operations where feasible.
• Incident Response Readiness: Update playbooks to address database-level compromise, including data exfiltration response procedures, forensic imaging of database servers, and credential rotation workflows.

References

1. NVD Entry — CVE-2026-72562: https://nvd.nist.gov/vuln/detail/CVE-2026-72562
2. Pimcore Security Advisories: https://github.com/pimcore (monitor for upcoming security advisories)
3. CWE-89 — SQL Injection: https://cwe.mitre.org/data/definitions/89.html
4. Pimcore Admin UI Classic Bundle (GitHub): https://github.com/pimcore/admin-ui-classic-bundle

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No known exploit-in-the-wild activity, active campaigns, or published exploit code has been identified at the time of this report. The absence of a patch may incentivize attacker research; organizations should remain vigilant for emerging exploitation patterns. Monitor threat intelligence feeds for any mention of CVE-2026-72562 as the vulnerability becomes publicly discussed.