CVE-2026-44741 pimcore CVE debrief

Who should care

Defenders responsible for Pimcore installations, particularly those using the Admin Classic Bundle, should assess exposure and apply patches or mitigations to prevent potential SQL injection attacks.

Why it matters

CVE-2026-44741 is a SQL injection vulnerability in Pimcore's Admin Classic Bundle that requires verification of exposure and prompt patching or mitigation to prevent potential attacks.

• Potential SQL injection attacks may lead to unauthorized data access or modification
• Successful exploitation may result in elevated privileges or compromise of the affected system
• Defenders should verify exposure and apply patches or mitigations to prevent potential attacks
• Remediation priority is high due to the high CVSS score and potential impact

Technical summary

The SQL injection vulnerability in Pimcore's Admin Classic Bundle is caused by the direct interpolation of user-supplied input into a SQL expression without proper parameterization or validation. This vulnerability affects versions prior to 2.3.6 and 1.7.18. The vulnerability has a high CVSS score of 8.8, indicating a high severity. The vulnerability is located in the translation grid date filter, and defenders should verify exposure and apply patches or mitigations to prevent potential SQL injection attacks. The affected product context is Pimcore's Admin Classic Bundle, and the defensive impact is high due to the potential for unauthorized data access or modification.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations to prevent potential SQL injection attacks.

Recommended defensive actions

• Verify exposure by checking if the installed version of Pimcore's Admin Classic Bundle is prior to 2.3.6 or 1.7.18
• Apply patches or upgrades to versions 2.3.6 or 1.7.18 to fix the SQL injection vulnerability
• Implement additional security measures, such as input validation and parameterization, to prevent SQL injection attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected versions. The vulnerability is caused by the direct interpolation of user-supplied input into a SQL expression without proper parameterization or validation. The affected versions are prior to 2.3.6 and 1.7.18. Defenders should verify exposure and apply patches or mitigations to prevent potential SQL injection attacks. The NVD entry and CVE record do not provide information on known or unknown affected scope, but defenders should

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.