Pimcore

v2026.1.5 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Data Warehouses & Analytics

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

cdp cms cms-framework customer-data-platform dam data-management

+13 more

digital-platform ecommerce ecommerce-platform experience-manager master-data-management mdm online-shop pim pimcore product-information-management product-management shop wcms

ReleasePort's take

Moderate signal

editorial:auto 1mo

The release patches a critical bug that rendered Symfony Scheduler commands unusable and adds security hardening against table injection attacks in Dependency DAO query handling.

Why it matters: Severity 90 regex check blocks table‑injection; Severity 40 fixes unusable Scheduler commands – operators must apply the update to restore functionality and protect data integrity.

Summary

AI summary

Fixed Symfony Scheduler commands being unusable (PEES-1043).

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Adds regex check and quoting to block table injection attacks Adds regex check and quoting to block table injection attacks Source: llm_adapter@2026-06-09 Confidence: high	—
Feature	Low	Adds DependencyTargetsChangedMessage to Dependency Dao Adds DependencyTargetsChangedMessage to Dependency Dao Source: llm_adapter@2026-06-09 Confidence: high	—
Bugfix
Bugfix	Medium	Adds missing check for assets image thumbnails status_cache configuration option Adds missing check for assets image thumbnails status_cache configuration option Source: llm_adapter@2026-06-09 Confidence: high	—
Bugfix	Medium	Fixes Symfony Scheduler commands becoming unusable Fixes Symfony Scheduler commands becoming unusable Source: llm_adapter@2026-06-09 Confidence: low	—
Bugfix	Low	Fixes statistics issue in Studio Fixes statistics issue in Studio Source: llm_adapter@2026-06-09 Confidence: high	—
Refactor	Low	Adds missing PhpDocs to DataObject\Listing class Adds missing PhpDocs to DataObject\Listing class Source: llm_adapter@2026-06-09 Confidence: high	—

Full changelog

What's Changed

[Task]: Add DependencyTargetsChangedMessage to Dependency Dao by @martineiber in https://github.com/pimcore/pimcore/pull/19156
[Bug, EC] PEES-1043: Symfony Scheduler - Commands not usable by @robertSt7 in https://github.com/pimcore/pimcore/pull/19170
[Bug]: Missing check if config "assets->image->thumbnails->status_cache" option is enabled/disabled by @kingjia90 in https://github.com/pimcore/pimcore/pull/19174
[Security]: Follow up regex check and add quoting to block tables by @kingjia90 in https://github.com/pimcore/pimcore/pull/19177
Statistics: fix for Studio by @brusch in https://github.com/pimcore/pimcore/pull/19115
DataObject\Listing: Add missing PhpDocs by @blankse in https://github.com/pimcore/pimcore/pull/18844

Full Changelog: https://github.com/pimcore/pimcore/compare/v2026.1.4...v2026.1.5

Security Fixes

Added regex check and quoting to block tables to prevent injection

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Pimcore

Get notified when new releases ship.

About Pimcore

Multi-channel experience and engagement management platform.

All releases →