CVE-2025-27617: Pimcore Vulnerable to SQL Injection in getRelationFilterCondition
Summary Authenticated users can craft a filter string used to cause a SQL injection.
Details Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer. This code does not look to sanitize inputs: https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Extension/RelationFilterConditionParser.php#L29-L47
c.f. with https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Multiselect.php#L332-L347
PoC Complete instructions, including specific configuration details, to reproduce the vulnerability.
Impact What kind of vulnerability is it? Who is impacted?
Other sources
Pimcore is an open source data and experience management platform. Prior to version 11.5.4, authenticated users can craft a filter string used to cause a SQL injection. Version 11.5.4 fixes the issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/pimcore/pimcoreto a version that resolves this vulnerability.Fixed in 11.5.4 - Upgrade
Upgrade
pimcoreto a version that resolves this vulnerability.Fixed in 11.5.4
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27617?
The severity of CVE-2025-27617 is considered to be high due to the potential for SQL injection vulnerabilities, which can lead to data compromise.
How do I fix CVE-2025-27617?
To fix CVE-2025-27617, upgrade to Pimcore version 11.5.4 or later where the vulnerability has been addressed.
Who is affected by CVE-2025-27617?
CVE-2025-27617 affects users of Pimcore versions prior to 11.5.4 who employ certain filter strings.
What kind of attack does CVE-2025-27617 allow?
CVE-2025-27617 allows authenticated users to conduct SQL injection attacks through crafted filter strings.
Is there a workaround for CVE-2025-27617?
There are no documented workarounds for CVE-2025-27617; upgrading to the patched version is the recommended approach.