Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name (CVE-2026-55634)

Pimcore generates PHP class files for DataObject classes by concatenating field names directly into the class source code without validating them as safe PHP identifiers. An attacker with ordinary 'objects' permission can import a class definition with a malicious field name that closes the property declaration and injects arbitrary PHP code, including a __construct() method that executes on object instantiation, resulting in remote code execution with the privileges of the PHP runtime. The same unvalidated field name is also used in SQL ALTER TABLE DDL statements without proper identifier quoting, enabling SQL injection. The RCE sink has been confirmed in an isolated test environment, while the full end-to-end exploit chain is reasoned from source code analysis. The vulnerability affects Pimcore versions before 12.3.10 and versions from 2026.1.0 up to 2026.1.6. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, scoring 9.9 critical.

An authenticated user with the standard 'objects' permission (not requiring administrator or special 'classes' permissions) can execute arbitrary PHP code on the server, leading to full server compromise including access to application secrets, database credentials, and the host filesystem/OS. The injected code executes every time an object of the malicious class is loaded. Additionally, the attacker can perform SQL injection via ALTER TABLE commands, potentially corrupting the database schema. The vulnerability scope is changed (S:C) due to execution beyond the application privileges. The severity is critical with a CVSS score of 9.9.

A patch is available for this vulnerability. Users should upgrade Pimcore to version 12.3.10 or later, or to a version later than 2026.1.6 if using the 2026.1.x series. Until patched, restrict the 'objects' permission to trusted users only. No vendor advisory content contradicts this; therefore, applying the official patch is the recommended remediation.