CVE-2026-44741 in Admin Classic Bundle
Summary
by MITRE • 08/12/2026
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied `property` field from the filter JSON is interpolated directly into a `UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...)))` SQL expression without parameterization or allowlist validation. Versiosn 2.3.6 and 1.7.18 fix the issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability identified in Pimcore's Admin Classic Bundle represents a critical sql injection flaw that undermines the integrity of the content management system's backend interface. This weakness specifically affects versions prior to 2.3.6 and 1.7.18, where the translation grid date filter functionality fails to properly sanitize user input before incorporating it into database queries. The vulnerability stems from the direct interpolation of a user-supplied property field from filter json data into a complex sql expression that includes unix_timestamp and date functions, creating an avenue for malicious actors to manipulate database operations through crafted input.
The technical implementation of this vulnerability demonstrates poor input validation practices where the system accepts raw user data without proper sanitization or parameterization. When administrators use the translation grid's date filtering feature, the property field from the json payload gets directly embedded into a sql query structure that processes timestamps and dates through multiple function calls including from_unixtime and unix_timestamp. This creates an environment where attackers can inject malicious sql fragments that bypass normal security controls, potentially allowing them to extract sensitive data, modify database contents, or execute unauthorized operations within the pimcore system.
The operational impact of this vulnerability extends beyond simple data exposure as it compromises the fundamental security model of the content management platform. Attackers exploiting this flaw could gain unauthorized access to translation data, potentially accessing sensitive information stored in the system's database. The vulnerability affects the backend administrative interface which typically contains privileged data and controls over content management operations, making it particularly dangerous for organizations relying on pimcore for enterprise content management. The attack surface is significant since the filter functionality is commonly used by administrators during routine content management tasks, increasing the likelihood of successful exploitation.
This vulnerability aligns with common weakness enumerations such as cwe-89 sql injection and follows patterns typically associated with attack techniques documented in the attack tree framework under command execution and data manipulation categories. The lack of proper input validation and parameterization represents a fundamental security gap that violates industry best practices for secure coding standards. Organizations using affected versions should immediately implement patch management procedures to upgrade to version 2.3.6 or 1.7.18 where the issue has been resolved through proper input sanitization. Additional mitigations include implementing web application firewalls, monitoring database access logs for suspicious activity, and conducting regular security assessments of administrative interfaces to identify similar vulnerabilities in other components of the system infrastructure.
The remediation approach for this vulnerability involves not only applying the official patches but also implementing comprehensive input validation mechanisms that prevent direct interpolation of user-supplied data into sql queries. Organizations should establish secure coding guidelines that mandate parameterized queries and input sanitization for all database interactions, particularly within administrative interfaces where privileged operations occur. Regular security training for development teams on sql injection prevention techniques and automated code review processes can help identify similar vulnerabilities before they can be exploited in production environments.