Description
An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger unintended SQL execution in the backend.
This issue affects pimcore: 12.3.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pimcore | pimcore | 12.3.3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | pimcore/pimcore | >= 12.0.0-RC1, < 12.3.7 | 12.3.7 | GHSA-r2f4-ff2p-xc64 |
| Packagist | pimcore/pimcore | < 11.5.17 | 11.5.17 | GHSA-r2f4-ff2p-xc64 |
| Packagist | pimcore/pimcore | >= 2026.1.0, < 2026.1.3 | 2026.1.3 | GHSA-r2f4-ff2p-xc64 |
References
- https://fluidattacks.com/es/advisories/dragons third-party-advisory
- https://github.com/pimcore/pimcore product
- https://github.com/pimcore/pimcore/pull/19108 patch