MediumGHSA-qjpx-5m2p-5pghCVE-2025-27617

Pimcore Vulnerable to SQL Injection in getRelationFilterCondition

Published 11 Mar 2025 · Updated 11 Mar 2025

Affected package

pimcore/pimcoreComposer

Affected: <11.5.4
Fixed in: 11.5.4

Update to the fixed version for your release line, for example:composer require pimcore/pimcore:^11.5.4

Details

Summary

Authenticated users can craft a filter string used to cause a SQL injection.

Details

_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._ This code does not look to sanitize inputs: https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Extension/RelationFilterConditionParser.php#L29-L47

c.f. with https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Multiselect.php#L332-L347

PoC

_Complete instructions, including specific configuration details, to reproduce the vulnerability._

Impact

_What kind of vulnerability is it? Who is impacted?_

Is GHSA-qjpx-5m2p-5pgh in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected pimcore/pimcore, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.