Medium severity4.9NVD Advisory· Published Feb 24, 2026· Updated Jun 17, 2026
CVE-2026-27461
CVE-2026-27461
Description
Pimcore is an Open Source Data & Experience Management Platform. In versions up to and including 11.5.14.1 and 12.3.2, the filter query parameter in the dependency listing endpoints is JSON-decoded and the value field is concatenated directly into RLIKE clauses without sanitization or parameterized queries. Exploiting this issue requires admin authentication. An attacker with admin panel access can extract the full database including password hashes of other admin users. Version 12.3.3 contains a patch.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
pimcore/pimcorePackagist | <= 11.5.14.1 | — |
pimcore/pimcorePackagist | >= 12.0.0, < 12.3.3 | 12.3.3 |
Affected products
3Patches
Vulnerability mechanics
References
6- github.com/pimcore/pimcore/commit/1c3925fbec4895abeb21e5c244a83679c4e4a6f4nvdPatchWEB
- github.com/pimcore/pimcore/pull/18991nvdIssue TrackingPatchWEB
- github.com/pimcore/pimcore/security/advisories/GHSA-vxg3-v4p6-f3fpnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-vxg3-v4p6-f3fpghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-27461ghsaADVISORY
- github.com/pimcore/pimcore/releases/tag/v12.3.3nvdProductRelease NotesWEB
News mentions
0No linked articles in our index yet.