~ / search / GHSA-qjpx-5m2p-5pgh

GHSA-qjpx-5m2p-5pgh

Pimcore Vulnerable to SQL Injection in getRelationFilterCondition

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-27617

Packages

EcosystemPackageAffectedFixed in
Packagist pimcore/pimcore < 11.5.4 11.5.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary Authenticated users can craft a filter string used to cause a SQL injection. ### Details _Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._ This code does not look to sanitize inputs: https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Extension/RelationFilterConditionParser.php#L29-L47 c.f. with https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Multiselect.php#L332-L347 ### PoC _Complete instructions, including specific configuration details, to reproduce the vulnerability._ ### Impact _What kind of vulnerability is it? Who is impacted?_

References

External links from the advisory. They lead to third-party sites.