CVE-2026-27461

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27461", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-19T17:25:31.100Z", "datePublished": "2026-02-24T02:50:48.287Z", "dateUpdated": "2026-02-24T18:58:07.625Z"}, "containers": {"cna": {"title": "Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/pimcore/pimcore/security/advisories/GHSA-vxg3-v4p6-f3fp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-vxg3-v4p6-f3fp"}, {"name": "https://github.com/pimcore/pimcore/pull/18991", "tags": ["x_refsource_MISC"], "url": "https://github.com/pimcore/pimcore/pull/18991"}, {"name": "https://github.com/pimcore/pimcore/commit/1c3925fbec4895abeb21e5c244a83679c4e4a6f4", "tags": ["x_refsource_MISC"], "url": "https://github.com/pimcore/pimcore/commit/1c3925fbec4895abeb21e5c244a83679c4e4a6f4"}, {"name": "https://github.com/pimcore/pimcore/releases/tag/v12.3.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/pimcore/pimcore/releases/tag/v12.3.3"}], "affected": [{"vendor": "pimcore", "product": "pimcore", "versions": [{"version": "<= 11.5.14.1", "status": "affected"}, {"version": ">= 12.0.0, < 12.3.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T02:50:48.287Z"}, "descriptions": [{"lang": "en", "value": "Pimcore is an Open Source Data & Experience Management Platform. In versions up to and including 11.5.14.1 and 12.3.2, the filter query parameter in the dependency listing endpoints is JSON-decoded and the value field is concatenated directly into RLIKE clauses without sanitization or parameterized queries. Exploiting this issue requires admin authentication. An attacker with admin panel access can extract the full database including password hashes of other admin users. Version 12.3.3 contains a patch."}], "source": {"advisory": "GHSA-vxg3-v4p6-f3fp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T18:56:21.259584Z", "id": "CVE-2026-27461", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T18:58:07.625Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27461", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-24T18:56:21.259584Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T18:56:41.952Z"}}], "cna": {"title": "Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause", "source": {"advisory": "GHSA-vxg3-v4p6-f3fp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "pimcore", "product": "pimcore", "versions": [{"status": "affected", "version": "<= 11.5.14.1"}, {"status": "affected", "version": ">= 12.0.0, < 12.3.3"}]}], "references": [{"url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-vxg3-v4p6-f3fp", "name": "https://github.com/pimcore/pimcore/security/advisories/GHSA-vxg3-v4p6-f3fp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/pimcore/pimcore/pull/18991", "name": "https://github.com/pimcore/pimcore/pull/18991", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pimcore/pimcore/commit/1c3925fbec4895abeb21e5c244a83679c4e4a6f4", "name": "https://github.com/pimcore/pimcore/commit/1c3925fbec4895abeb21e5c244a83679c4e4a6f4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pimcore/pimcore/releases/tag/v12.3.3", "name": "https://github.com/pimcore/pimcore/releases/tag/v12.3.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Pimcore is an Open Source Data & Experience Management Platform. In versions up to and including 11.5.14.1 and 12.3.2, the filter query parameter in the dependency listing endpoints is JSON-decoded and the value field is concatenated directly into RLIKE clauses without sanitization or parameterized queries. Exploiting this issue requires admin authentication. An attacker with admin panel access can extract the full database including password hashes of other admin users. Version 12.3.3 contains a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T02:50:48.287Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27461", "state": "PUBLISHED", "dateUpdated": "2026-02-24T18:58:07.625Z", "dateReserved": "2026-02-19T17:25:31.100Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-24T02:50:48.287Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "pimcore", "vendor": "pimcore", "versions": [{"status": "affected", "version": "<= 11.5.14.1"}, {"status": "affected", "version": ">= 12.0.0, < 12.3.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*", "matchCriteriaId": "39E909B5-0004-472B-A619-AF6C4FA46A56", "versionEndIncluding": "11.5.14.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC86C038-C1FD-49B3-968A-A8C58970F02B", "versionEndExcluding": "12.3.3", "versionStartIncluding": "12.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Pimcore is an Open Source Data & Experience Management Platform. In versions up to and including 11.5.14.1 and 12.3.2, the filter query parameter in the dependency listing endpoints is JSON-decoded and the value field is concatenated directly into RLIKE clauses without sanitization or parameterized queries. Exploiting this issue requires admin authentication. An attacker with admin panel access can extract the full database including password hashes of other admin users. Version 12.3.3 contains a patch."}, {"lang": "es", "value": "Pimcore es una Plataforma de Gesti\u00f3n de Datos y Experiencias de C\u00f3digo Abierto. En versiones hasta las 11.5.14.1 y 12.3.2 incluidas, el par\u00e1metro de consulta filter en los endpoints de listado de dependencias se decodifica en JSON y el campo de valor se concatena directamente en cl\u00e1usulas RLIKE sin sanitizaci\u00f3n o consultas parametrizadas. Para explotar este problema es preciso estar autenticado como administrador. Un atacante con acceso al panel de administrador puede extraer la base de datos completa, incluyendo los hashes de contrase\u00f1a de otros usuarios administradores. La versi\u00f3n 12.3.3 contiene un parche."}], "id": "CVE-2026-27461", "lastModified": "2026-06-17T10:27:11.590", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27461", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-24T18:56:21.259584Z", "version": "2.0.3"}}]}, "published": "2026-02-24T04:15:58.787", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/pimcore/pimcore/commit/1c3925fbec4895abeb21e5c244a83679c4e4a6f4"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/pimcore/pimcore/pull/18991"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/pimcore/pimcore/releases/tag/v12.3.3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-vxg3-v4p6-f3fp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,11.5.14.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.0.0,12.3.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "pimcore", "source": "cna", "vendor": "pimcore"}, "product": "pimcore", "vendor": "pimcore"}], "analysis": {"en": {"generated_at": "2026-04-17T15:52:24.191517+00:00", "value": {"mitigation_remediation": ["Upgrade Pimcore to version 12.3.3 or later, which contains the fixed query handling code.", "If upgrading is temporarily infeasible, restrict or disable the dependency listing endpoint for non\u2011admin users and enforce strict access controls.", "Sanitize any custom or legacy filter inputs by using parameterized queries or escaping to prevent injection into RLIKE clauses.", "Monitor system logs for unauthorized database access attempts and verify that admin credentials remain protected."], "summary": {"action": "Immediate Patch", "impact": "SQL injection enabling extraction of database contents including password hashes"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all installations of Pimcore up to and including version 11.5.14.1 and 12.3.2. The patch was released with version 12.3.3. Administrators should check the installed package version and apply the update if they are running a vulnerable release.", "description_and_impact": "Pimcore, an open source data and experience management platform, was found to have a flaw in how it handles filter query parameters for its dependency listing endpoints. The value field of the JSON\u2011decoded filter is concatenated directly into an RLIKE clause without sanitization or use of parameterized queries. This oversight allows an authenticated attacker with access to the administration panel to inject arbitrary SQL into the backend query. The resulting injection can read the entire database, giving the attacker password hashes of other admin users and a full view of confidential data. The weakness is a classic example of unsafe input handling, identified as CWE\u201189.", "risk_and_exploitability": "The CVSS score of 6.9 indicates medium severity, but the EPSS score of less than 1\u202f% suggests very low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploit requires admin authentication and a request to the dependency listing API, so the vector is authenticated internal. An attacker who can log into the administration panel can leverage the injection to extract the complete database and recover password hashes, providing long\u2011term access and severe confidentiality compromise."}}}}, "created": "2026-02-24T09:53:06.033659+00:00", "updated": "2026-04-17T16:00:11.378003+00:00", "vendors": ["pimcore", "pimcore$PRODUCT$pimcore"]}