Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause
The filter query parameter in the dependency listing endpoints is JSON-decoded and the value field is concatenated directly into RLIKE clauses without sanitization or parameterized queries.
Affected code in models/Dependency/Dao.php:
- getFilterRequiresByPath() lines 90, 95, 100
- getFilterRequiredByPath() lines 148, 153, 158
All 6 locations use direct string concatenation like:
"AND LOWER(CONCAT(o.path, o.key)) RLIKE '".$value."'"Note that $orderBy and $orderDirection in the same methods (lines 75-81) ARE properly whitelist-validated, but $value has zero sanitization.
Entry points (pimcore/admin-ui-classic-bundle ElementController.php):
- GET /admin/element/get-requires-dependencies (line 654)
- GET /admin/element/get-required-by-dependencies (line 714)
The controller JSON-decodes the filter query param and passes $filter['value'] straight to the Dao without any escaping.
PoC (time-based blind):
GET /admin/element/get-requires-dependencies?id=1&elementType=document&filter=[{"type":"string","value":"x' OR SLEEP(5)#"}]If vulnerable, the response is delayed by ~15 seconds (SLEEP runs 3 times, once per UNION arm in the inner subquery).
PoC (error-based extraction):
GET /admin/element/get-requires-dependencies?id=1&elementType=document&filter=[{"type":"string","value":"x' OR extractvalue(1,concat(0x7e,(SELECT version())))#"}]Returns the MySQL version string in the error response.
Requires admin authentication. An attacker with admin panel access can extract the full database including password hashes of other admin users.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | pimcore/pimcore | <= 11.5.14.1, >= 12.0.0, < 12.3.3 | 12.3.3 |
References
- https://github.com/pimcore/pimcore/security/advisories/GHSA-vxg3-v4p6-f3fp
- https://nvd.nist.gov/vuln/detail/CVE-2026-27461
- https://github.com/pimcore/pimcore/pull/18991
- https://github.com/pimcore/pimcore/commit/1c3925fbec4895abeb21e5c244a83679c4e4a6f4
- https://github.com/pimcore/pimcore
- https://github.com/pimcore/pimcore/releases/tag/v12.3.3
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-89- Platform
- Composer
- Package
pimcore/pimcore- Disclosed
- 24.02.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-vxg3-v4p6-f3fp - CC BY 4.0
Vulnerability history: pimcore/pimcore
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 135
- First → latest
- 12.2019 09.2026
- Without a fix
- 3
- Exploited in attacks
- 0
Severity breakdown
- Critical 5
- High 40
- Medium 90
Disclosures per year
- 2019: 1
- 2020: 0
- 2021: 11
- 2022: 43
- 2023: 59
- 2024: 3
- 2025: 2
- 2026: 16
-
Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.