An authenticated administrator who can import or save DataObject class definitions may embed malicious composite index metadata, which the Pimcore backend accepts and executes as SQL. This flaw can allow the attacker to manipulate database queries and access, modify, or delete data without proper authorization. The vulnerability is a classic SQL injection, identified as CWE-89, and can potentially compromise data confidentiality and integrity.

Pimcore Platform version 12.3.3 is affected. The issue applies across all operating systems supported by this release, including Linux, macOS, and Windows environments that run this version.

The CVSS score of 7.0 indicates a high severity. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. The attack requires an authenticated administrator with the ability to modify DataObject classes, so the threat vector is internal. Once compromised, the attacker can execute arbitrary SQL statements against the backend database, posing a significant risk to the integrity and confidentiality of the stored data.