What is the CVSS score of EUVD-2026-56032?

EUVD-2026-56032 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Pimcore admin-ui-classic-bundle are affected by EUVD-2026-56032?

A SQL injection vulnerability in Pimcore admin-ui-classic-bundle (versions through 2.3) allows authenticated backend users to bypass database security controls and directly manipulate organizational…

How to fix or mitigate EUVD-2026-56032?

Within 24 hours, identify all Pimcore deployments running admin-ui-classic-bundle through version 2.3, verify installed versions, and audit backend user access logs for suspicious DataObject grid filter queries. Within 7 days, implement database activity monitoring to detect anomalous SQL patterns in DataObject filter context, restrict admin-ui-classic backend access to essential personnel via role-based access control, and configure Web Application Firewall rules to flag SQL syntax within filter parameters. Within 30 days, evaluate migration to alternative platforms or await patched Pimcore versions with formal security advisories, establish subscription to Pimcore security alerts, and perform a comprehensive audit of database-level permissions to identify over-privileged accounts.

Pimcore admin-ui-classic-bundle EUVD-2026-56032

| CVE-2026-72562 HIGH

SQL Injection (CWE-89)

2026-08-11 TuranSec

GHSA-676q-ggmp-8439

SQLi Pimcore Pimcore Admin Ui Classic Bundle

8.8

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-accessible admin UI requires low-privilege backend credentials (PR:L); no interaction needed; unsanitized SQL injection yields full database C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 12:14 vuln.today

CVE Published

Aug 11, 2026 - 11:13 cve.org

HIGH 8.8

DescriptionCVE.org

An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause without parameterization. An attacker with backend access can exfiltrate or modify all database contents.

AnalysisAI

SQL injection in Pimcore admin-ui-classic-bundle (all versions through 2.3) permits authenticated backend users to execute arbitrary SQL against the underlying database via the DataObject grid id column filter. The filter value is concatenated unsanitized directly into a SQL WHERE clause, bypassing parameterization entirely, enabling an attacker to exfiltrate or modify all database contents. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS score of 8.8 with full C/I/A:H impact and the straightforward CWE-89 pattern make this a meaningful risk for any unpatched Pimcore deployment.

Technical ContextAI

The vulnerability resides in Pimcore's admin-ui-classic-bundle, a PHP-based backend UI package for the open-source Pimcore data and content management platform. The affected component is identified by CPE cpe:2.3:a:pimcore:pimcore_admin-ui-classic-bundle:*:*:*:*:*:*:*:* covering all releases through version 2.3. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-supplied input in the DataObject grid's id column filter is concatenated directly into a SQL WHERE clause without the use of prepared statements or parameterized queries. This classic unsanitized string interpolation pattern allows an attacker to alter the query's logical structure, enabling arbitrary SELECT, UPDATE, INSERT, or DELETE operations on the database backing the Pimcore installation. The DataObject grid is a core feature of the Pimcore admin interface, making the vulnerable code path broadly accessible to any authenticated backend user.

RemediationAI

The primary remediation is to upgrade Pimcore admin-ui-classic-bundle to a version beyond 2.3 once a patched release is published; no specific patched version number was confirmed in the available intelligence at time of analysis, so operators should monitor the upstream repository at https://github.com/pimcore/admin-ui-classic-bundle for a tagged release addressing this issue. As an immediate compensating control, restrict backend access to the Pimcore admin interface to the minimum necessary set of trusted users, enforce multi-factor authentication on all backend accounts to reduce credential-compromise risk, and - where architecturally feasible - place the admin UI behind a VPN or IP allowlist to prevent direct internet exposure, which eliminates network-level reachability for most attackers. Deploying a Web Application Firewall with SQL injection detection rules in front of the Pimcore admin interface provides an additional detective and preventive layer, though WAF bypass remains possible for skilled attackers. Database query logging with alerting on anomalous WHERE clause patterns can serve as a detective control until a vendor patch is applied.