{"action":"Upgrade pimcore/pimcore to 12.3.9 or later.","affected":[{"fixed":"2026.1.5","introduced":"2026.1.0"},{"fixed":"12.3.9","introduced":"0"}],"component":"pimcore/pimcore","cve_ids":["CVE-2026-55072"],"ecosystem":"Packagist","epss":0.00409,"exploited":false,"fixed_versions":["2026.1.5","12.3.9"],"ghsa_id":"GHSA-2mhj-fhvg-v428","id":"tcs_01M5KES2WH6CQJE6J8B159E11E","modified_at":"2026-08-13T14:10:58.634872Z","published_at":"2026-08-13T13:44:24Z","references":["https://osv.dev/vulnerability/GHSA-2mhj-fhvg-v428","https://github.com/pimcore/pimcore/security/advisories/GHSA-2mhj-fhvg-v428","https://github.com/pimcore/pimcore/commit/33a0e1887e1e31b4283b016ac5440c35ea5697b4","https://github.com/pimcore/pimcore"],"severity":{"label":"high","score":8.5},"sources":[{"source":"osv","source_id":"GHSA-2mhj-fhvg-v428","url":"https://osv.dev/vulnerability/GHSA-2mhj-fhvg-v428"}],"summary":"Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name"}