Pimcore DataObject Import Flaw Lets Standard Users Achieve RCE via Unvalidated Field Names

What happened

A newly published GitHub Security Advisory (GHSA-9x44-4gxf-8c25, tracked as CVE-2026-55634) reports that Pimcore's DataObject class-definition import concatenates a field name directly into generated PHP class source (protected $<fieldName>;) without an identifier allowlist. According to the advisory, a user holding only the standard objects permission — not an admin or dedicated "classes" permission — can supply a crafted field name during class import to inject arbitrary PHP into the generated class file, which executes when an object of that class is loaded. The researcher states the injection sink itself was confirmed to execute attacker-supplied shell commands in an isolated lab harness against the unmodified builder code; the full chain through the live Studio import API is described as reasoned from source rather than independently run end-to-end. The same unvalidated field name is also reportedly concatenated into ALTER TABLE DDL, giving a parallel SQL-injection path. The advisory notes this is a sibling issue to CVE-2026-5394, whose fix hardened only a related composite-index sink and left this field-name path unaddressed. CVSS is listed at 9.9.

Why it matters for defenders

If accurate, this significantly lowers the bar for compromising Pimcore deployments: the reported access requirement is a routine content-editor permission rather than administrative access, and the outcome is full remote code execution on the application server, with the SQL-injection path offering a secondary avenue for schema tampering. Organizations running Pimcore with broadly distributed objects permissions — a common configuration for content teams — should treat this as a priority to track, since low-privileged or even semi-trusted internal/external users could be the source of an intrusion.

What defenders should watch for now

• Inventory Pimcore instances and identify which users/roles hold the objects (DataObjects) permission.
• Monitor for unexpected changes to generated class files under the DataObject class storage path, particularly the appearance of function or constructor definitions in files that should only contain simple property declarations.
• Increase logging/alerting priority on class-definition import events, especially from non-administrative accounts.
• Watch for unusual ALTER TABLE activity (unexpected ADD COLUMN/ADD INDEX) tied to DataObject class saves.
• Until an official patch is confirmed, consider restricting class-definition import to trusted/administrative accounts as an interim mitigation.

Developing intel

This is a same-day advisory disclosure and details may evolve as the vendor responds and a fix is released. No official Pimcore patch status is confirmed in the source material reviewed here. For the full technical writeup, proof-of-concept details, and vendor updates, see the original advisory: GHSA-9x44-4gxf-8c25.