CVE-2026-44741highCWE-89

CVE-2026-44741: high-severity vulnerability in pimcore

Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter

Published

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 0.5%
exploitation probability
0.5%top 59% of all CVEs
observed exploitation
nono source reports it
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied `property` field from the filter JSON is interpolated directly into a `UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...)))` SQL expression without parameterization or allowlist validation. Versiosn 2.3.6 and 1.7.18 fix the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
pimcore · pimcore
Related CVEs — pimcore

In the same product, most dangerous first.

CVE-2022-39365CRITICALRCE vulnerability in Pimcore/Mail & Dynamic Text LayoutEPSS 1.8%CVE-2022-31092HIGHSQL injection in pimcoreEPSS 1.4%CVE-2021-39189MEDIUMObservable Response Discrepancy in Lost Password ServiceEPSS 1.4%CVE-2021-39170HIGHImproper Encoding or Escaping of Output in Asset Metadata ComponentEPSS 1.2%CVE-2023-47637HIGHSQL Injection in Admin Grid Filter API in PimcoreEPSS 1.2%CVE-2021-37702HIGHImproper Neutralization of Formula Elements in a CSV File in pimcore/pimcoreEPSS 1.1%
References
https://github.com/pimcore/admin-ui-classic-bundle/commit/80e57a23d9e19574eddfe9b08e8f26785b2b0d90https://github.com/pimcore/admin-ui-classic-bundle/pull/1111https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v2.3.6https://github.com/pimcore/pimcore/security/advisories/GHSA-h4ph-crvj-9h92