Pimcore’s Admin Search Find API contains an incomplete SQL injection fix that allows an attacker with administrative credentials to inject SQL payloads without relying on comments. The vulnerability enables blind extraction of database information, compromising the integrity and confidentiality of all stored data. The flaw is a classic input validation weakness classified as CWE-89.

The affected product is Pimcore, a data and experience management platform. Versions earlier than 12.3.1 and 11.5.14 are impacted, while the vulnerability is resolved in those released updates. The flaw is present in the admin interface’s search functionality and does not affect unauthenticated users.

The CVSS score of 8.8 indicates a high severity flaw, with a low but non-zero EPSS score of less than 1 percent. The issue is not listed in the CISA Known Exploited Vulnerabilities catalog, reflecting that no public exploits have been reported yet. The attack requires authenticated access to the admin UI, making the likelihood dependent on the security of admin accounts but otherwise straightforward once credentials are compromised.