CVE-2026-44741: Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter
(updated )
SQL injection in Pimcore’s translation grid date filter — the user-supplied property field from the filter JSON is interpolated directly into a UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...))) SQL expression without parameterization or allowlist validation.
References
- github.com/advisories/GHSA-h4ph-crvj-9h92
- github.com/pimcore/admin-ui-classic-bundle/commit/80e57a23d9e19574eddfe9b08e8f26785b2b0d90
- github.com/pimcore/admin-ui-classic-bundle/pull/1111
- github.com/pimcore/admin-ui-classic-bundle/releases/tag/v2.3.6
- github.com/pimcore/pimcore/security/advisories/GHSA-h4ph-crvj-9h92
- nvd.nist.gov/vuln/detail/CVE-2026-44741
Code Behaviors & Features
Detect and mitigate CVE-2026-44741 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →