CVE-2026-55634
- Source
- https://cve.org/CVERecord?id=CVE-2026-55634
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55634.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-55634
- Aliases
- Related
- Published
- 2026-08-28T19:16:20Z
- Modified
- 2026-10-28T02:30:47Z
- Severity
-
- 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- Pimcore: Remote Code Execution via DataObject Class-Definition Field Name
- Details
-
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import accepts a DataObject field name that is emitted without an identifier allowlist by lib/DataObject/ClassBuilder/FieldDefinitionPropertiesBuilder.php into generated PHP properties and by models/DataObject/ClassDefinition/Helper/Dao.php into ALTER TABLE identifiers. An authenticated user with the objects permission can inject PHP syntax into the generated DataObject class, causing attacker-controlled code in generated var/classes/DataObject/.php files to run when an object of that class is instantiated, and can also inject SQL identifier content into schema-changing statements. The central models/DataObject/ClassDefinition/Data.php::setName() validation did not reject semicolons, braces, backticks, spaces, or other non-identifier characters. This issue is fixed in versions 11.5.19, 12.3.10, and 2026.1.6.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-89", "CWE-94" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55634.json", "unresolved_ranges": [ { "extracted_events": [ { "range": [ { "fixed": "11.5.19" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" } ] } ] }- References
-
- https://github.com/pimcore/pimcore/releases/tag/v2026.1.6
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55634.json
- https://github.com/advisories/GHSA-r2f4-ff2p-xc64
- https://github.com/pimcore/pimcore/security/advisories/GHSA-9x44-4gxf-8c25
- https://nvd.nist.gov/vuln/detail/CVE-2026-55634
- https://github.com/pimcore/pimcore/commit/a4f8c3cfee58b7d5fe4873d67782eff58dae9b9d
- https://github.com/pimcore/pimcore/pull/19183
Affected packages
Git / github.com/pimcore/pimcore
Affected ranges
- Type
- GIT
- Repo
- https://github.com/pimcore/pimcore
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "12.0.0-RC1" }, { "fixed": "12.3.10" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "2026.1.0" }, { "fixed": "2026.1.6" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "a4f8c3cfee58b7d5fe4873d67782eff58dae9b9d" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v2026.1.6", "range": [ { "fixed": "ad60bad41946c33bebb4fd42e03b0a575759de02" } ], "source": "REFERENCES_TAG" } ] }