CVE-2026-55072

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the beginning of...

CVE-2026-55072 Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the beginning of...

CVE-2026-55072

Pimcore is an open-source Data & Experience Management Platform. In versions prior to 2026.1.5 , a missing trailing $ anchor in the ClassDefinition UID validation regex (ClassDefinition.php) combined with an unquoted $object->getClassId() concatenation in Block.php allows an authenticated user...