The vulnerability arises from a missing trailing '$' anchor in the regular expressions validating ClassDefinition UIDs in Pimcore. This allows an attacker with authenticated 'objects' permission to create a class with a UID that starts with a valid identifier but contains appended SQL injection payloads. When data objects of this class are loaded, Block.php concatenates the raw classId directly into SQL queries without quoting, leading to SQL injection. The issue is an incomplete fix from a prior commit that added a leading '^' anchor but omitted the trailing '$'. The vulnerability affects Pimcore versions >=2026.1.0 <2026.1.5 and versions <12.3.9. A proof of concept demonstrates extracting password hashes from the users table via SQL injection. The recommended fix is to add the trailing '$' anchor to the regex patterns to properly validate the entire UID string and prevent injection.

An authenticated user with the 'objects' permission can exploit this vulnerability to perform SQL injection by creating a malicious class UID. This can lead to unauthorized disclosure of sensitive data such as password hashes from the users table. The vulnerability allows reading data beyond intended access controls but does not directly enable denial of service or privilege escalation. The CVSS score is 8.5 (high severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact.

A patch is available that adds the missing trailing '$' anchors to the ClassDefinition UID validation regex patterns, preventing malicious UIDs from passing validation. Users should upgrade Pimcore to versions 2026.1.5 or later, or 12.3.9 or later, where this fix is applied. Until patched, restrict 'objects' permission to trusted users only. No other mitigations are specifically recommended by the vendor advisory.