CVE-2026-72562: Pimcore pimcore admin-ui-classic-bundle - SQL Injection

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-11 · updated 2026-10-24
Weakness: CWE-89

Description

An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause without parameterization. An attacker with backend access can exfiltrate or modify all database contents.

Affected products

pimcore admin-ui-classic-bundle: through 2.3

References

https://github.com/pimcore/admin-ui-classic-bundle

Get alerted when CVE-2026-72562 or the next vulnerability affects your stack