Pimcore CVE-2026-5394

Requires an authenticated administrative user (PR:H) with the specific capability to import or save DataObject class definitions in the Pimcore backend; the malicious payload must be placed in the compositeIndices metadata (most reliably compositeIndices.index_columns, alternatively index_key) of the imported class-definition JSON. Exploitation is triggered when Pimcore rebuilds composite indices and interpolates the value into ALTER TABLE ADD/DROP INDEX DDL. Limiting factors: it is not remote-unauthenticated - an attacker without admin/class-definition rights cannot reach the vulnerable flow; no user interaction is needed beyond the attacker's own import/save action; affected only on unpatched builds (<= 12.3.6, <= 11.5.16, or 2026.1.0-2026.1.2).

This is a real but access-gated issue, not a mass-exploitation threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L) and score 7.0 hinge on PR:H - the attacker must already hold administrative rights to import/save class definitions, which sharply narrows the attacker population. Corroborating low-urgency signals: EPSS is 0.01% (2nd percentile), the issue is not in CISA KEV, and CISA SSVC scores Exploitation: none, Automatable: no, Technical Impact: partial. No public exploit code has been identified. The main risk is post-authentication privilege abuse: a compromised or malicious admin (or a supply-chain/import-of-untrusted-class-definition scenario) turning DDL configuration into arbitrary SQL, giving full read of the database (VC:H) and limited write/availability impact. Treat as a standard-priority patch, prioritized higher where admin accounts are broadly delegated or class definitions are imported from untrusted sources.

An attacker who has obtained an administrative Pimcore session (or a rogue insider) crafts a DataObject class-definition JSON where compositeIndices.index_columns contains an injected ALTER TABLE subclause, then imports or saves it. When Pimcore rebuilds the composite indices it concatenates the value into an ADD INDEX statement executed via Doctrine DBAL, running the attacker's SQL against the object tables. No public POC is available, but network attack vector and low complexity (AV:N/AC:L) mean the only real barrier is the required admin privilege.