{"action":"Upgrade pimcore/admin-ui-classic-bundle to 1.7.18 or later.","affected":[{"fixed":"2.3.6","introduced":"2.0.0-RC1"},{"fixed":"1.7.18","introduced":"0"}],"component":"pimcore/admin-ui-classic-bundle","cve_ids":["CVE-2026-44741"],"ecosystem":"Packagist","epss":0.005,"exploited":false,"fixed_versions":["2.3.6","1.7.18"],"ghsa_id":"GHSA-h4ph-crvj-9h92","id":"tcs_01M5KF3APY953CWZB6MSR61TEQ","modified_at":"2026-07-10T19:15:11.856742087Z","published_at":"2026-05-27T00:35:56Z","references":["https://osv.dev/vulnerability/GHSA-h4ph-crvj-9h92","https://github.com/pimcore/pimcore/security/advisories/GHSA-h4ph-crvj-9h92","https://github.com/pimcore/admin-ui-classic-bundle/pull/1111","https://github.com/pimcore/admin-ui-classic-bundle/commit/80e57a23d9e19574eddfe9b08e8f26785b2b0d90","https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v2.3.6","https://github.com/pimcore/pimcore"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-h4ph-crvj-9h92","url":"https://osv.dev/vulnerability/GHSA-h4ph-crvj-9h92"}],"summary":"Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter"}