CVE-2026-55634: Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name

Any authenticated user with the objects permission — the standard permission for content editors who work with DataObjects, not an administrator or a dedicated “classes” permission — can:

1. Execute arbitrary PHP on the server (RCE). The injected code runs in the web application’s PHP process when an object of the affected class is loaded (and is re-executed on every load), with full access to the application, its database credentials, secrets, and the host filesystem/OS — i.e. full server compromise.
2. Execute arbitrary ALTER TABLE DDL (SQL injection) against the DataObject store/query tables (drop columns, add indexes, corrupt schema). Confidence (read with the Reproduction section). The RCE sink — the real builder emitting attacker PHP into the generated class body, that class loading, and its __construct() executing a shell command — is runtime-confirmed in an isolated harness (see Reproduction → “Lab confirmation”). The remaining links of the end-to-end chain are reasoned from source but not yet run end-to-end on a live Pimcore: (a) the Studio import path (generateLayoutTreeFromArray → save) preserving the field name without transform/reject; (b) the persistent-field DDL step not aborting the save (addressed by the ≤64-byte gadget); and (c) Pimcore instantiating the object (new, e.g. via DataObject::getById()) so __construct() fires — autoloading alone executes only top-level class-body code, not the constructor. Treat the RCE as sink-confirmed + chain-reasoned, not as a fully-executed live exploit.

Because the injected PHP executes with the privileges of the PHP runtime (typically the web-server user) and reaches the operating system — beyond the authority of the Pimcore application account the attacker started from — the scope is assessed Changed (S:C), consistent with Pimcore’s own scoring of the analogous Custom-Reports SQL injection (GHSA-3234-gxc3-pq6f, AV:N/AC:L/PR:L/UI:R/S:C, 8.7); the result here is RCE rather than read-only SQLi, yielding 9.9 Critical. S:C is the one debatable metric: a reviewer who scores the impact within the single PHP/OS authority as S:U lands at AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High. The severity floor is therefore High regardless of the scope interpretation.