CVE-2026-23492
High · 8.8Pimcore Has an Incomplete Patch for CVE-2023-30848
CVSS
8.8
EPSS
0.5%
Published
Jan 14, 2026
CISA due date
—
The record
An **incomplete SQL injection patch** in the Admin Search Find API allows an authenticated attacker to perform **blind SQL injection**. Although CVE-2023-30848 attempted to mitigate SQL injection by removing SQL comments (--) and catching syntax errors, the fix is insufficient. Attackers can still inject SQL payloads that do not rely on comments and infer database information via blind techniques. This vulnerability affects the admin interface and can lead to **database information disclosure**.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | pimcore/pimcore | 0 | 11.5.14 |
| Packagist | pimcore/pimcore | 12.0.0-RC1 | 12.3.1 |
| packagist | pimcore/pimcore | 12.0.0-RC1 | 12.3.1 |
Related vulnerabilities
- GHSA-qvr7-7g55-69xj Pimcore Has an Incomplete Patch for CVE-2023-30848 Same vulnerability
- GHSA-vxg3-v4p6-f3fp Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE… Also affects pimcore/pimcore
- CVE-2026-27461 Pimcore is an Open Source Data & Experience Management Platform. Also affects pimcore/pimcore
- GHSA-m3r2-724c-pwgf Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on… Also affects pimcore/pimcore
- GHSA-q433-j342-rp9h Pimcore ENV Variables and Cookie Informations are exposed in http_error_log Also affects pimcore/pimcore
- CVE-2026-23493 Pimcore ENV Variables and Cookie Informations are exposed in http_error_log Also affects pimcore/pimcore
- CVE-2026-23494 Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on… Also affects pimcore/pimcore
- CVE-2022-1429 SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to… Also affects pimcore/pimcore