CVE-2026-5394: Pimcore

High severity, CVSS 7.0. EPSS: 0.6% chance of exploitation in the next 30 days.

An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger unintended SQL execution in the backend. This issue affects pimcore: 12.3.3.

Affected products

• Pimcore Pimcore: version 12.3.3 only

Published 2026-04-27. Last modified 2026-06-17.