CVE-2026-44741: 
PHP Análise e mitigação de vulnerabilidades

CVE-2026-44741 is a SQL injection vulnerability in Pimcore's Admin Classic Bundle affecting the translation grid date filter. The user-supplied property field from the filter JSON is interpolated directly into a UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...))) SQL expression without parameterization or allowlist validation. Affected versions are pimcore/admin-ui-classic-bundle < 1.7.18 and >= 2.0.0-RC1, <= 2.3.5. The vulnerability was published on May 27, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (Github Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). In src/Controller/Admin/TranslationController.php, when a filter of type: "date" is processed via the POST /admin/translation/translations endpoint, the property field is extracted at line 565 and subjected only to a trivially bypassable str_replace('--', '', $fieldname) sanitization at line 569. The unsanitized value is then concatenated into the SQL expression UNIX_TIMESTAMP(DATE(FROM_UNIXTIME({$fieldname}))) at line 593 without quoting or parameterization. The -- comment bypass can be circumvented using /**/ block comments or ---- sequences, allowing UNION-based or error-based SQL injection. The advisory also notes that chaining this vulnerability with a related unsafe unserialize issue (GM-249) could enable an SQLi → deserialization → RCE attack chain (Github Advisory, Pimcore Advisory).

An authenticated user with translations view permission can extract arbitrary data from the database via UNION-based or error-based SQL injection, compromising confidentiality of all database contents including user credentials. Integrity and availability are also rated High, as an attacker could modify or delete database records. Depending on database server permissions, OS-level command execution may be possible, and when chained with the related unsafe deserialization vulnerability, a full remote code execution attack chain becomes feasible (Github Advisory, Pimcore Advisory).

A proof-of-concept payload is publicly documented in the security advisory itself, demonstrating UNION-based SQL injection via the property field. The NVD SSVC assessment classifies exploitation as "poc" (proof-of-concept available). There is no current evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.035% (28th percentile), indicating a low but non-negligible probability of exploitation in the near term. Exploitation requires low privileges (authenticated backend user with translation grid access) and no user interaction (Github Advisory).

1. Authenticate: Obtain credentials for a Pimcore backend user account with at minimum the translations view permission.
2. Identify the endpoint: Target the POST /admin/translation/translations endpoint on a Pimcore instance running admin-ui-classic-bundle < 1.7.18 or >= 2.0.0-RC1, <= 2.3.5.
3. Craft the malicious filter payload: Construct a JSON filter array with type: "date" and inject SQL into the property field, bypassing the -- strip by using /**/ comments or ----. Example PoC:

POST /admin/translation/translations
filter=[{"property":"1))) UNION SELECT password FROM users WHERE ((1","type":"date","operator":"eq","value":"2026-01-01"}]

4. Extract data: Analyze the HTTP response for injected query results (e.g., password hashes from the users table) returned via UNION-based injection.
5. Escalate (optional): If database permissions allow, use INTO OUTFILE or LOAD_FILE for file system access, or chain with the unsafe unserialize vulnerability (GM-249) to achieve remote code execution (Pimcore Advisory, Github Advisory).

• Network: Unusual or repeated POST requests to /admin/translation/translations containing JSON filter parameters with SQL keywords (UNION, SELECT, FROM, WHERE) or comment sequences (/**/, ----) in the property field.
• Logs: Web server access logs showing POST requests to the translations endpoint with encoded or anomalous filter parameter values; database error logs indicating malformed SQL expressions involving UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...))).
• Application: Unexpected query results or data leakage visible in translation grid responses; database audit logs showing queries accessing unrelated tables (e.g., users) from the Pimcore application user.

Upgrade pimcore/admin-ui-classic-bundle to version 2.3.6 (for the 2.x branch) or 1.7.18 (for the LTS 1.x branch), which implement an allowlist of valid non-language field names and replace raw string interpolation with $db->quoteIdentifier() for date filter expressions (Github Advisory, v2.3.6 Release). As a temporary workaround prior to patching, restrict access to the translation grid to only trusted users, and consider deploying WAF rules to detect and block SQL injection patterns in the filter POST parameter. Implementing allowlist validation for the property field to restrict it to known safe column names (key, type, creationDate, modificationDate) is the recommended code-level mitigation (Pimcore Advisory).