CVE-2026-55072
1 advisory.
Packagist/pimcore/pimcore CVE-2026-55072: high 8.5
Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
Action: Upgrade pimcore/pimcore to 12.3.9 or later.
composer require pimcore/pimcore:2026.1.5composer require pimcore/pimcore:12.3.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 2026.1.0 | 2026.1.5 | - |
| 0 | 12.3.9 | - |
Fixed versions
| 2026.1.5 | 12.3.9 |
Sources
- osv: GHSA-2mhj-fhvg-v428
- https://github.com/pimcore/pimcore/security/advisories/GHSA-2mhj-fhvg-v428
- https://github.com/pimcore/pimcore/commit/33a0e1887e1e31b4283b016ac5440c35ea5697b4
- https://github.com/pimcore/pimcore
CVE-2026-55072 · published · modified · JSON