CVE-2026-55634

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 11.5.19 Pimcore versions prior to 12.3.10 Pimcore versions prior to 2026.1.6

Description An authenticated user with objects permission can achieve remote code execution (RCE) and perform SQL injection via the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import. The issue occurs because the application fails to properly validate DataObject field names, allowing them to be emitted without an identifier allowlist into generated PHP properties in lib/DataObject/ClassBuilder/FieldDefinitionPropertiesBuilder.php and into ALTER TABLE identifiers in models/DataObject/ClassDefinition/Helper/Dao.php.

An attacker can inject PHP syntax into the generated DataObject class files located in var/classes/DataObject/.php, which executes when an object of that class is instantiated. Additionally, the lack of validation allows the injection of SQL identifier content into schema-changing statements, enabling the attacker to drop columns, add indexes, or corrupt the database schema. The root cause is that the setName() function in models/DataObject/ClassDefinition/Data.php does not reject characters such as semicolons, braces, backticks, or spaces.

Recommendations Update to version 11.5.19 or later. Update to version 12.3.10 or later. Update to version 2026.1.6 or later. As a temporary mitigation, restrict access to the /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import endpoint to administrators only or disable class-definition imports in production environments.