The flaw exists in Pimcore’s class-definition import endpoint. An authenticated user with objects permission can submit a field name that bypasses the library’s identifier allowlist and injects PHP syntax into generated class files and SQL identifiers into ALTER TABLE statements. This permits an attacker to embed and execute arbitrary PHP code when an instance of the altered class is created, and also allows injection of malformed SQL identifiers into schema‑changing queries.

All releases of Pimcore before 11.5.19, before 12.3.10, and before 2026.1.6 are vulnerable. The affected functionality is the /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import endpoint and the internal class‑builder that emits PHP property definitions.

The CVSS score of 9.9 signals critical severity. No EPSS score is available and the vulnerability has not been listed in the CISA KEV catalog. Exposing the flaw requires a legitimate user with objects permission; once the crafted field name is imported, the platform will execute the injected PHP on the next object instantiation or on any use of schema‑altering queries, granting the attacker remote code execution capabilities with high confidence.