THREAT OPS › Threat News › [GHSA] GHSA-2mhj-fhvg-v428 (high) — Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
[GHSA] GHSA-2mhj-fhvg-v428 (high) — Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
GHSA-2mhj-fhvg-v428 Severity: high CVE: CVE-2026-55072
Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
### Summary A missing end anchor (`$`) in the ClassDefinition UID validation regex allows an authenticated user with the `objects` permission to create a class with a malicious UID containing SQL. When a data object of that class is l
Indicators of compromise
- CVE-2026-55072cve
- https://your-pimcore/pimcore-studio/api/loginurl
- https://your-pimcore/pimcore-studio/api/class/definition/configuration-view/detail/createurl
- https://your-pimcore/pimcore-studio/api/data-objectsurl
- https://your-pimcore/pimcore-studio/api/data-objects/42url
Original source: https://github.com/advisories/GHSA-2mhj-fhvg-v428