Pimcore, an open source data and experience management platform, was found to have a flaw in how it handles filter query parameters for its dependency listing endpoints. The value field of the JSON‑decoded filter is concatenated directly into an RLIKE clause without sanitization or use of parameterized queries. This oversight allows an authenticated attacker with access to the administration panel to inject arbitrary SQL into the backend query. The resulting injection can read the entire database, giving the attacker password hashes of other admin users and a full view of confidential data. The weakness is a classic example of unsafe input handling, identified as CWE‑89.

The vulnerability affects all installations of Pimcore up to and including version 11.5.14.1 and 12.3.2. The patch was released with version 12.3.3. Administrators should check the installed package version and apply the update if they are running a vulnerable release.

The CVSS score of 6.9 indicates medium severity, but the EPSS score of less than 1 % suggests very low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploit requires admin authentication and a request to the dependency listing API, so the vector is authenticated internal. An attacker who can log into the administration panel can leverage the injection to extract the complete database and recover password hashes, providing long‑term access and severe confidentiality compromise.