Pimcore Vulnerable to SQL Injection in getRelationFilterCondition

HIGH 8.8CVE-2025-27617 · GHSA-qjpx-5m2p-5pgh · Published 11/03/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
pimcore/pimcore Packagist	`< 11.5.4`	`11.5.4`
pimcore pimcore	`< 11.5.4`	`11.5.4`

Description

Summary

Authenticated users can craft a filter string used to cause a SQL injection.

Details

Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer. This code does not look to sanitize inputs: https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Extension/RelationFilterConditionParser.php#L29-L47

c.f. with https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Multiselect.php#L332-L347

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.

Impact

What kind of vulnerability is it? Who is impacted?

NVD description

Pimcore is an open source data and experience management platform. Prior to version 11.5.4, authenticated users can craft a filter string used to cause a SQL injection. Version 11.5.4 fixes the issue.

References

pimcore/pimcore security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2025-27617 · ADVISORY
pimcore/pimcore commit 19a8520 · WEB
pimcore/pimcore · PACKAGE
pimcore/pimcore · WEB
pimcore/pimcore · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free