CVE-2026-27461

MEDIUM EPSS 36.4%
Published Feb 24, 20264mo ago · Modified Jun 17, 20262w ago
6.9 CVSS 4.0
Medium
Find Similar
Published Feb 24, 2026 4mo ago
Last Modified Jun 17, 2026 2w ago

Description

Pimcore is an Open Source Data & Experience Management Platform. In versions up to and including 11.5.14.1 and 12.3.2, the filter query parameter in the dependency listing endpoints is JSON-decoded and the value field is concatenated directly into RLIKE clauses without sanitization or parameterized queries. Exploiting this issue requires admin authentication. An attacker with admin panel access can extract the full database including password hashes of other admin users. Version 12.3.3 contains a patch.

CVSS Details

Base Score
6.9
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
36.4% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-89 SQL Injection Injection

Affected Products 2

VendorProductVersionRange
pimcorepimcore* ≤11.5.14.1
pimcorepimcore*≥12.0.0  –  <12.3.3

References 4

  • github.com https://github.com/pimcore/pimcore/commit/1c3925fbec4895abeb21e5c244a83679c4e4a6f4
    Patch
  • github.com https://github.com/pimcore/pimcore/pull/18991
    Issue TrackingPatch
  • github.com https://github.com/pimcore/pimcore/releases/tag/v12.3.3
    ProductRelease Notes
  • github.com https://github.com/pimcore/pimcore/security/advisories/GHSA-vxg3-v4p6-f3fp
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/pimcore/pimcore/commit/1c3925fbec4895abeb21e5c244a83679c4e4a6f4
    Patch
  • github.com https://github.com/pimcore/pimcore/pull/18991
    Issue TrackingPatch