CyberRota Analysis
AI-GeneratedThe vulnerability allows standard editor-level users in Pimcore to create class definitions through the Studio API without requiring admin privileges, potentially leading to unauthorized database modifications and PHP file generation. Additionally, the lack of proper UID format validation at the API layer may expose the system to internal exceptions and further exploitation. Organizations using affected versions should prioritize upgrading to versions 2025.4.6 or 2026.1.6 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, the Studio API class definition creation endpoint POST /pimcore-studio/api/class/definition/configuration-view/detail/create is guarded by the objects permission instead of the classes permission, allowing a standard editor-level user to create class definitions without admin privileges. Class definition creation generates new database tables and PHP class files on the server, and missing API-layer UID format validation allows malformed UIDs to reach model-layer validation and return internal exceptions. This issue is fixed in versions 2025.4.6 and 2026.1.6.