Vulnerability Description
An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger unintended SQL execution in the backend. This issue affects pimcore: 12.3.3.
Related Weaknesses (CWE)
References
- https://fluidattacks.com/es/advisories/dragons
- https://github.com/pimcore/pimcore
- https://github.com/pimcore/pimcore/pull/19108
FAQ
What is CVE-2026-5394?
CVE-2026-5394 is a documented vulnerability. An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger unintended SQL execution in the backend. T...
How severe is CVE-2026-5394?
CVSS scoring is not yet available for CVE-2026-5394. Check NVD for updates.
Is there a patch for CVE-2026-5394?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.