CVE-2023-30850 Pimcore SQL Injection Vulnerability in Admin Translations API

High 8.8 Published 27 Apr 2023 Updated 30 Jan 2025

Attackers can execute arbitrary SQL commands via the admin translations API, potentially reading or modifying database contents.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-30850?

CVE-2023-30850 is a high-severity SQL injection vulnerability in Pimcore Pimcore, published on 27 Apr 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Pimcore is an open source data and experience management platform. Prior to version 10.5.21, a SQL Injection vulnerability exists in the admin translations API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch manually.

Weakness: CWE-89

Which versions are affected by CVE-2023-30850?

2 open source packages ship an affected version, including pimcore/pimcore. It affects 1 product.

Package	Affected	Fixed in
`pimcore/pimcore` Packagist	All versions	`10.5.21`
`pimcore/pimcore` Packagist	All versions	`10.5.21`

Products include Pimcore Pimcore.

How do I fix CVE-2023-30850?

Upgrade pimcore/pimcore to 10.5.21 or later.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2023-30850 being exploited?

There is no known exploitation of CVE-2023-30850 in the wild and no public exploit code.

All Pimcore Pimcore vulnerabilities

Sources

Also known as GHSA-jwg4-qcgv-5wg6.