---
title: "CVE-2026-55634: Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name"
url: https://erroneo.us/security/cve/CVE-2026-55634/
description: "CVE-2026-55634 (pimcore/pimcore (Composer (PHP))): Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-08-28
date_modified: 2026-08-28
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-55634"
kev: false
cvss: 9.9
epss: 0.0065
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-55634: Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- Not in CISA KEV , but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 0.7% , percentile 50: FIRST’s model estimates a 0.7% chance of exploitation activity in the next 30 days, higher than 50% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Needs an account (low (any account)). Exposure depends on who can log in.
- Only applies if your dependency tree includes pimcore/pimcore (Composer (PHP)) <= 12.3.9, fixed in 12.3.10 ; pimcore/pimcore (Composer (PHP)) >= 2026.1.0, <= 2026.1.5, fixed in 2026.1.6 . Check your lockfile, including transitive dependencies.

## What it is

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import accepts a DataObject field name that is emitted without an identifier allowlist by lib/DataObject/ClassBuilder/FieldDefinitionPropertiesBuilder.php into generated PHP properties and by models/DataObject/ClassDefinition/Helper/Dao.php into ALTER TABLE identifiers. An authenticated user with the objects permission can inject PHP syntax into the generated DataObject class, causing attacker-controlled code in generated var/classes/DataObject/.php files to run when an object of that class is instantiated, and can also inject SQL identifier content into schema-changing statements. The central models/DataObject/ClassDefinition/Data.php::setName() validation did not reject semicolons, braces, backticks, spaces, or other non-identifier characters. This issue is fixed in versions 11.5.19, 12.3.10, and 2026.1.6.

## Affected packages

- Composer (PHP) `pimcore/pimcore` <= 12.3.9 → fixed: 12.3.10
- Composer (PHP) `pimcore/pimcore` >= 2026.1.0, <= 2026.1.5 → fixed: 2026.1.6

## Affected products (CVE record)

- pimcore pimcore: < 11.5.19, >= 12.0.0-RC1, < 12.3.10, >= 2026.1.0, < 2026.1.6

## Severity

- GitHub_M CVSS 3.1: 9.9 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`
- GitHub CVSS 3.1: 9.9 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.65% probability of exploitation activity in the next 30 days; percentile 50.

## Sources

- [GitHub Advisory GHSA-9x44-4gxf-8c25](https://github.com/advisories/GHSA-9x44-4gxf-8c25)
- [CVE.org record CVE-2026-55634](https://www.cve.org/CVERecord?id=CVE-2026-55634)
- [NVD entry CVE-2026-55634](https://nvd.nist.gov/vuln/detail/CVE-2026-55634)
- [github.com](https://github.com/pimcore/pimcore/security/advisories/GHSA-9x44-4gxf-8c25)
- [github.com](https://github.com/pimcore/pimcore/pull/19183)
- [github.com](https://github.com/pimcore/pimcore/commit/a4f8c3cfee58b7d5fe4873d67782eff58dae9b9d)
- [github.com](https://github.com/advisories/GHSA-r2f4-ff2p-xc64)
- [github.com](https://github.com/pimcore/pimcore/releases/tag/v2026.1.6)

---
Source page: https://erroneo.us/security/cve/CVE-2026-55634/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt