PT-2026-2947 · Pimcore · Pimcore

Snow1Nd · Published 2026-01-14 · Updated 2026-01-20 · CVE-2026-23492

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 12.3.1 Pimcore versions prior to 11.5.14

Description Pimcore is an Open Source Data & Experience Management Platform. An incomplete SQL injection patch in the Admin Search Find API allows an authenticated attacker to perform blind SQL injection. The initial patch attempted to mitigate SQL injection by removing SQL comments and catching syntax errors, but this fix was insufficient as attackers can still inject SQL payloads that do not rely on comments and infer database information via blind techniques. This affects the admin interface and can lead to database information disclosure. The vulnerable API endpoint is /admin/search/find. The vulnerability is exploitable through crafted SQL payloads submitted to the API.

Recommendations Update Pimcore to version 12.3.1 or later. Update Pimcore to version 11.5.14 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-23492

GHSA-QVR7-7G55-69XJ

Affected Products

Pimcore

References · 14

• 🔥 https://github.com/pimcore/pimcore/security/advisories/GHSA-qvr7-7g55-69xj · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23492.json · Exploit
• https://github.com/pimcore/pimcore/commit/25ad8674886f2b938243cbe13e33e204a2e35cc3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23492 · Security Note
• https://osv.dev/vulnerability/GHSA-qvr7-7g55-69xj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23492 · Vendor Advisory
• https://github.com/pimcore/pimcore · Note
• https://twitter.com/CVEnew/status/2011555152256516405 · Twitter Post
• https://twitter.com/CveFindCom/status/2011523510582001955 · Twitter Post
• https://twitter.com/TheHackerWire/status/2011521067224088689 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2011600484751048949 · Twitter Post
• https://twitter.com/_cvereports/status/2011604973839176098 · Twitter Post
• https://github.com/advisories/GHSA-6mhm-gcpf-5gr8 · Note
• https://t.me/cveNotify/149346 · Telegram Post