CVE-2026-44741: 
PHP vulnerability analysis and mitigation

CVE-2026-44741 is a SQL injection vulnerability in the Pimcore Admin Classic Bundle (pimcore/admin-ui-classic-bundle) affecting the translation grid date filter. The user-supplied property field from the filter JSON is interpolated directly into a UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...))) SQL expression without parameterization or allowlist validation. All versions up to and including 2.3.5 are affected; version 2.3.6 (and LTS 1.7.18) contain the fix. The vulnerability was published on May 26–27, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Pimcore Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). In src/Controller/Admin/TranslationController.php, the property field from a JSON filter parameter is read at line 565, subjected to a trivially bypassable str_replace('--', '', $fieldname) sanitization at line 569 (bypassable via /**/ comments or ----), and then concatenated directly into a raw SQL expression at line 593: $fieldname = "UNIX_TIMESTAMP(DATE(FROM_UNIXTIME({$fieldname})))". The vulnerable endpoint is POST /admin/translation/translations, and exploitation requires only low-privilege authenticated access (translations view permission). A proof-of-concept payload is publicly documented in the advisory: filter=[{"property":"1))) UNION SELECT password FROM users WHERE ((1","type":"date","operator":"eq","value":"2026-01-01"}] (GitHub Advisory, Pimcore Advisory).

An authenticated attacker with translations view permission can execute arbitrary SQL queries against the database via UNION-based or error-based injection, enabling extraction of sensitive data including user credentials. Integrity and availability are also fully impacted (CVSS C:H/I:H/A:H). Critically, the advisory notes that chaining this vulnerability with a related unsafe unserialize issue (GM-249/CVE-2026-27461) creates an SQLi → deserialization → Remote Code Execution attack chain, potentially allowing full server compromise (GitHub Advisory, Pimcore Advisory).

A proof-of-concept payload is publicly documented in the GitHub Security Advisory, lowering the bar for exploitation significantly. There is no current evidence of in-the-wild exploitation or threat actor attribution. The CVE status remains "Reserved" and it is not listed in the CISA KEV catalog. No EPSS score is currently available (GitHub Advisory, Feedly).

1. Reconnaissance: Identify Pimcore instances running pimcore/admin-ui-classic-bundle version ≤ 2.3.5 by fingerprinting the admin interface or checking publicly exposed Composer metadata.
2. Obtain low-privilege credentials: Acquire or compromise an account with translations view permission (a low-privilege role within Pimcore's admin panel).
3. Authenticate: Log in to the Pimcore admin interface and obtain a valid session cookie or CSRF token.
4. Craft malicious request: Send a POST request to /admin/translation/translations with a crafted filter JSON parameter containing a SQL injection payload in the property field with type: "date":

   POST /admin/translation/translations
   filter=[{"property":"1))) UNION SELECT password FROM users WHERE ((1","type":"date","operator":"eq","value":"2026-01-01"}]

5. Bypass sanitization: If needed, bypass the str_replace('--', '') filter by using /**/ as a comment delimiter or ---- (which reduces to -- after the replace, but can be further obfuscated).
6. Extract data: Analyze the response to retrieve injected query results (e.g., password hashes from the users table) via UNION-based injection.
7. Escalate (optional): Chain extracted credentials or database content with the unsafe unserialize vulnerability (GM-249) to achieve Remote Code Execution on the server (GitHub Advisory, Pimcore Advisory).

• Network: Unusual POST requests to /admin/translation/translations containing filter parameters with SQL keywords such as UNION, SELECT, FROM, WHERE, or comment sequences (/**/, ----) in the property field.
• Logs: Web server or application access logs showing repeated or anomalous requests to the translation endpoint with encoded or obfuscated filter JSON payloads; database error logs indicating malformed SQL expressions involving UNIX_TIMESTAMP or FROM_UNIXTIME.
• Database: Unexpected queries in the database slow query log or general query log referencing UNION SELECT against the users table or other sensitive tables, originating from the Pimcore application user.
• Application: Pimcore application logs showing PHP errors or unexpected query results from TranslationController.php around lines 565–593 (GitHub Advisory).

Upgrade pimcore/admin-ui-classic-bundle to version 2.3.6 (or 1.7.18 for LTS users), which adds an allowlist check for non-language field names and replaces raw string interpolation with $db->quoteIdentifier($fieldname) (Pimcore Release, GitHub Advisory). As a temporary workaround prior to patching, restrict access to the translation grid to only the minimum required users, and deploy WAF rules to detect and block SQL injection patterns (e.g., UNION SELECT, /**/) in POST body filter parameters targeting /admin/translation/translations. Implementing allowlist validation for the property field to only permit known safe column names (key, type, creationDate, modificationDate) is the core remediation approach applied in the patch.