CVE-2026-23492: Pimcore Has an Incomplete Patch for CVE-2023-30848

January 14, 2026 (updated January 21, 2026)

An incomplete SQL injection patch in the Admin Search Find API allows an authenticated attacker to perform blind SQL injection. Although CVE-2023-30848 attempted to mitigate SQL injection by removing SQL comments (–) and catching syntax errors, the fix is insufficient. Attackers can still inject SQL payloads that do not rely on comments and infer database information via blind techniques. This vulnerability affects the admin interface and can lead to database information disclosure.

References

github.com/advisories/GHSA-6mhm-gcpf-5gr8
github.com/advisories/GHSA-qvr7-7g55-69xj
github.com/pimcore/pimcore
github.com/pimcore/pimcore/commit/25ad8674886f2b938243cbe13e33e204a2e35cc3
github.com/pimcore/pimcore/security/advisories/GHSA-qvr7-7g55-69xj
nvd.nist.gov/vuln/detail/CVE-2026-23492

Code Behaviors & Features

Detect and mitigate CVE-2026-23492 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →