CVE-2026-5394 Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling
An authenticated admin can inject SQL via DataObject composite index metadata, allowing unauthorized database access or modification.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-5394?
CVE-2026-5394 is a high-severity SQL injection vulnerability in pimcore, published on 27 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger unintended SQL execution in the backend.
This issue affects pimcore: 12.3.3.
Weakness: CWE-89
Which versions are affected by CVE-2026-5394?
6 open source packages ship an affected version, including pimcore/pimcore.
| Package | Affected | Fixed in |
|---|---|---|
pimcore/pimcore Packagist | All versions | 11.5.17 |
pimcore/pimcore Packagist | All versions | 11.5.17 |
pimcore/pimcore Packagist | From 12.0.0-RC1 | 12.3.7 |
pimcore/pimcore Packagist | From 12.0.0-RC1 | 12.3.7 |
pimcore/pimcore Packagist | From 2026.1.0 | 2026.1.3 |
pimcore/pimcore Packagist | From 2026.1.0 | 2026.1.3 |
How do I fix CVE-2026-5394?
Upgrade pimcore/pimcore to a fixed version for your release line: 11.5.17, 12.3.7 or 2026.1.3.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-5394 being exploited?
There is no known exploitation of CVE-2026-5394 in the wild and no public exploit code.
Sources
Also known as GHSA-r2f4-ff2p-xc64.