Description

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied `property` field from the filter JSON is interpolated directly into a `UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...)))` SQL expression without parameterization or allowlist validation. Versiosn 2.3.6 and 1.7.18 fix the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-12T18:17:29.823Z",
  "pubdate": "2026-08-12T18:17:29.823Z",
  "executiveSummary": "An SQL injection vulnerability exists in Pimcore's Admin Classic Bundle translation grid date filter.\nThe flaw allows attackers to manipulate backend database queries through unvalidated input.\nAffected products include Pimcore Admin Classic Bundle versions prior to 2.3.6 and 1.7.18.\nSuccessful exploitation compromises the underlying database confidentiality, integrity, and availability.\nThe vulnerability requires an authenticated context with access to the translation grid interface to supply malicious parameters within the filter JSON structure.",
  "technicalDetails": "The root cause of the vulnerability is the lack of parameterization and allowlist validation on the user-supplied property field within the translation grid date filter JSON.\nThe vulnerable component directly interpolates the unverified property parameter into a UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...))) SQL expression.\nAffected versions comprise Pimcore Admin Classic Bundle versions prior to 2.3.6 and 1.7.18.\nAttack flow begins when an authenticated user intercepts or crafts an HTTP request targeting the translation grid functionality.\nThe attacker modifies the JSON filter payload, injecting arbitrary SQL commands into the property field.\nBecause the input is concatenated directly into the dynamic SQL query string rather than handled via prepared statements or bound parameters, the database query parser executes the injected SQL commands.\nPost-exploitation impact includes unauthorized data extraction, database enumeration, potential privilege escalation within the database context, and potential execution of administrative database operations depending on database configuration and user privileges."
}