GHSA-vxg3-v4p6-f3fp
NoneCVSS
—
EPSS
—
Published
Feb 24, 2026
CISA due date
—
The record
Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | pimcore/pimcore | 0 | No fix |
| Packagist | pimcore/pimcore | 12.0.0 | 12.3.3 |
Related vulnerabilities
- CVE-2026-27461 Pimcore is an Open Source Data & Experience Management Platform. Same vulnerability
- GHSA-m3r2-724c-pwgf Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on… Also affects pimcore/pimcore
- GHSA-q433-j342-rp9h Pimcore ENV Variables and Cookie Informations are exposed in http_error_log Also affects pimcore/pimcore
- CVE-2026-23493 Pimcore ENV Variables and Cookie Informations are exposed in http_error_log Also affects pimcore/pimcore
- CVE-2026-23494 Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on… Also affects pimcore/pimcore
- GHSA-qvr7-7g55-69xj Pimcore Has an Incomplete Patch for CVE-2023-30848 Also affects pimcore/pimcore
- CVE-2026-23492 Pimcore Has an Incomplete Patch for CVE-2023-30848 Also affects pimcore/pimcore
- CVE-2022-1429 SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to… Also affects pimcore/pimcore