CVE-2026-27461

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-27461
Pimcore is an Open Source Data & Experience Management Platform. In versions up to and including 11.5.14.1 and 12.3.2, the filter query parameter in the dependency listing endpoints is JSON-decoded and the value field is concatenated directly into RLIKE clauses without sanitization or parameterized queries. Exploiting this issue requires admin authentication. An attacker with admin panel access can extract the full database including password hashes of other admin users. Version 12.3.3 contains a patch.

4.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/pimcore/pimcore/commit/1c3925fbec4895abeb21e5c244a83679c4e4a6f4 Patch
https://github.com/pimcore/pimcore/pull/18991 Issue Tracking Patch
https://github.com/pimcore/pimcore/releases/tag/v12.3.3 Product Release Notes
https://github.com/pimcore/pimcore/security/advisories/GHSA-vxg3-v4p6-f3fp Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*
cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*
History

25 Feb 2026, 19:11

Type Values Removed Values Added
First Time Pimcore
Pimcore pimcore
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.9
Summary
  • (es) Pimcore es una Plataforma de Gestión de Datos y Experiencias de Código Abierto. En versiones hasta las 11.5.14.1 y 12.3.2 incluidas, el parámetro de consulta filter en los endpoints de listado de dependencias se decodifica en JSON y el campo de valor se concatena directamente en cláusulas RLIKE sin sanitización o consultas parametrizadas. Para explotar este problema es preciso estar autenticado como administrador. Un atacante con acceso al panel de administrador puede extraer la base de datos completa, incluyendo los hashes de contraseña de otros usuarios administradores. La versión 12.3.3 contiene un parche.
CPE cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*
References () https://github.com/pimcore/pimcore/commit/1c3925fbec4895abeb21e5c244a83679c4e4a6f4 - () https://github.com/pimcore/pimcore/commit/1c3925fbec4895abeb21e5c244a83679c4e4a6f4 - Patch
References () https://github.com/pimcore/pimcore/pull/18991 - () https://github.com/pimcore/pimcore/pull/18991 - Issue Tracking, Patch
References () https://github.com/pimcore/pimcore/releases/tag/v12.3.3 - () https://github.com/pimcore/pimcore/releases/tag/v12.3.3 - Product, Release Notes
References () https://github.com/pimcore/pimcore/security/advisories/GHSA-vxg3-v4p6-f3fp - () https://github.com/pimcore/pimcore/security/advisories/GHSA-vxg3-v4p6-f3fp - Exploit, Vendor Advisory

24 Feb 2026, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-24 04:15

Updated : 2026-02-25 19:11

NVD link : CVE-2026-27461

Mitre link : CVE-2026-27461

CVE.ORG link : CVE-2026-27461

JSON object : View

Products Affected

pimcore

  • pimcore
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')