CVE-2026-55634 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-55634 requires immediate attention.

· 6 min read

Executive Summary

CVE-2026-55634 is a critical remote code execution flaw in Pimcore’s DataObject class-definition handling. A user with only the ordinary objects permission can import a crafted class definition whose field name is copied unsafely into generated PHP and SQL. In practice, that can let an authenticated editor execute arbitrary code on the server, alter database schema, and potentially take full control of the application host.

Severity: CRITICAL (CVSS 9.9). KEV: No. Exploited in the wild: No known public exploitation at time of writing. Even so, this is a high-priority patch-now issue because the attack path is low-friction and requires only standard content-editor access.

Immediate Action

  • Upgrade Pimcore immediately to the first vendor-fixed release for your branch. TODO: insert vendor advisory / fixed version link here.
  • If you cannot patch today, disable class-definition import for non-admin users or block the import endpoint at the reverse proxy/WAF.
  • Restrict the objects permission to trusted staff only; review any accounts that can import or edit DataObject classes.
  • Isolate the service until patched: limit outbound network access, protect secrets, and ensure the web user has minimal OS privileges.
  • Rollback guidance: if a suspicious import occurred, restore var/classes/DataObject/*.php from a known-good backup and rotate application secrets.

Affected Versions

  • composer pimcore/pimcore@<= TODO-fixed-version vulnerable; upgrade to TODO-fixed-version+.
  • composer pimcore/pimcore releases that include the unpatched DataObject import path are affected.
  • Safe versions: the first release that adds identifier allowlisting for DataObject field names and hardens identifier handling in the class-definition import path. TODO: confirm exact fixed release from vendor advisory.

Resolution Guide

Composer / PHP

composer show pimcore/pimcore
composer require pimcore/pimcore:^TODO-fixed-version --update-with-all-dependencies
php bin/console cache:clear

Docker

docker pull pimcore/pimcore:TODO-fixed-tag
# or update your image tag in compose/k8s manifests
docker compose up -d --pull always

Debian/Ubuntu package workflows

apt-cache policy pimcore
sudo apt-get update
sudo apt-get install --only-upgrade pimcore

RHEL/CentOS/Fedora

yum info pimcore
sudo yum update pimcore

Hardening until patched

# Block the class-definition import route at the edge if possible
# Example nginx pattern:
location ~* /class/definition/configuration-view/detail/.*/import {
    deny all;
}

# Or restrict it to admin IPs only

Minimal code fix idea — reject unsafe field names before save/import:

if (!preg_match('/^[a-zA-Z][a-zA-Z0-9_]{0,62}$/', $name)) {
    throw new \InvalidArgumentException('Invalid field name');
}

Defense in depth: use identifier-safe quoting for SQL identifiers, and do not interpolate field names into generated PHP unless they pass a strict allowlist.

Detection & Verification

Check whether you are vulnerable

composer show pimcore/pimcore
grep -R "FieldDefinitionPropertiesBuilder\|generateLayoutTreeFromArray\|importClassDefinitionFromJson" vendor/pimcore -n
grep -R "protected \$" var/classes/DataObject/ -n | head

Look for suspicious generated classes

grep -R "function __construct\|shell_exec\|system(\|exec(" var/classes/DataObject/ -n
find var/classes/DataObject -type f -name '*.php' -mtime -7 -ls

Verify the fix

# Attempt a harmless import using an invalid field name; it should now fail
# Also confirm the import endpoint is blocked for non-admin users

# Re-run version check after upgrade
composer show pimcore/pimcore

Dependency auditors

composer audit

Operational checks

  • Review access logs for POSTs to /class/definition/configuration-view/detail/*/import.
  • Alert on unexpected changes to var/classes/DataObject/*.php.
  • Investigate any generated class file containing unexpected function declarations or unusual identifier names.

Risk and Impact

This bug can turn a normal content-editor account into a server-compromise path. An attacker who can import a crafted DataObject class definition may execute arbitrary PHP in the web process, read application secrets, access the database, and modify or destroy data. Because the same input also reaches SQL DDL generation, the blast radius includes schema corruption and potential service outage.

If your Pimcore instance is internet-facing or used by multiple editors, treat this as an urgent patch-and-review event. Even without known active exploitation, the combination of low required privileges and full server impact makes this a top-priority remediation item.

Keep reading