{"action":"Upgrade pimcore/pimcore to 12.3.3 or later.","affected":[{"introduced":"0","last_affected":"11.5.14.1"},{"fixed":"12.3.3","introduced":"12.0.0"}],"component":"pimcore/pimcore","cve_ids":["CVE-2026-27461"],"ecosystem":"Packagist","epss":0.00509,"exploited":false,"fixed_versions":["12.3.3"],"ghsa_id":"GHSA-vxg3-v4p6-f3fp","id":"tcs_01M5KF9J2CSHDZGEQ3HGHAX5VV","modified_at":"2026-02-24T20:26:19.719168Z","published_at":"2026-02-24T20:03:23Z","references":["https://osv.dev/vulnerability/GHSA-vxg3-v4p6-f3fp","https://github.com/pimcore/pimcore/security/advisories/GHSA-vxg3-v4p6-f3fp","https://nvd.nist.gov/vuln/detail/CVE-2026-27461","https://github.com/pimcore/pimcore/pull/18991","https://github.com/pimcore/pimcore/commit/1c3925fbec4895abeb21e5c244a83679c4e4a6f4","https://github.com/pimcore/pimcore","https://github.com/pimcore/pimcore/releases/tag/v12.3.3"],"severity":{"label":"medium","score":4.9},"sources":[{"source":"osv","source_id":"GHSA-vxg3-v4p6-f3fp","url":"https://osv.dev/vulnerability/GHSA-vxg3-v4p6-f3fp"},{"source":"nvd","source_id":"CVE-2026-27461","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27461"}],"summary":"Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause"}