A critical vulnerability in Pimcore, an open-source Data & Experience Management Platform, allows authenticated users with objects permission to perform PHP code injection and SQL injection attacks. The flaw exists in the class-definition import endpoint which accepts DataObject field names without proper validation. Malicious field names can be injected into generated PHP class files and ALTER TABLE SQL statements. The root cause is insufficient input validation in the setName() method, which failed to reject special characters like semicolons, braces, backticks, and spaces. Exploitation can lead to remote code execution when a DataObject of the affected class is instantiated. The vulnerability affects Pimcore versions prior to 11.5.19, 12.3.10, and 2026.1.6. Patches have been released in versions 11.5.19, 12.3.10, and 2026.1.6.
