PT-2026-21658 · Pimcore · Pimcore

Q1Uf3Ng · Published 2026-02-24 · Updated 2026-02-25 · CVE-2026-27461

Positive Technologies · (AI Summary)

CVSS v4.0

6.9

Medium

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pimcore versions up to and including 11.5.14.1 Pimcore versions up to and including 12.3.2

Description Pimcore is an Open Source Data & Experience Management Platform. The filter query parameter in the dependency listing endpoints is processed without proper sanitization, allowing for potential database extraction. Specifically, the parameter is JSON-decoded and its value is directly incorporated into RLIKE clauses without adequate security measures. Successful exploitation requires administrative authentication. An attacker with admin panel access could potentially extract the entire database, including password hashes of other administrative users. The affected endpoints involve dependency listing functionality. The vulnerable parameter is filter query.

Recommendations Update to Pimcore version 12.3.3 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-27461

GHSA-VXG3-V4P6-F3FP

Affected Products

Pimcore

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27461.json · Exploit
• https://github.com/pimcore/pimcore/commit/1c3925fbec4895abeb21e5c244a83679c4e4a6f4 · Patch
• https://github.com/pimcore/pimcore/security/advisories/GHSA-vxg3-v4p6-f3fp · Vendor Advisory
• https://github.com/pimcore/pimcore/pull/18991 · Patch
• https://osv.dev/vulnerability/GHSA-vxg3-v4p6-f3fp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27461 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27461 · Vendor Advisory
• https://github.com/pimcore/pimcore · Note
• https://github.com/pimcore/pimcore/releases/tag/v12.3.3 · Note
• https://twitter.com/VulmonFeeds/status/2026271606448791684 · Twitter Post
• https://twitter.com/_cvereports/status/2026532689222758433 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1refon9/resumen_diario_de_vulnerabilidades_25022026 · Reddit Post
• https://twitter.com/CVEnew/status/2026184600633172300 · Twitter Post
• https://t.me/CVEtracker/45571 · Telegram Post
• https://t.me/cveNotify/152964 · Telegram Post