Skip to content

Pimcore

v2026.2.4 Feature

This release adds 6 notable features for engineering teams evaluating rollout.

Published 5d Data Warehouses & Analytics
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

cdp cms cms-framework customer-data-platform dam data-management
+13 more
digital-platform ecommerce ecommerce-platform experience-manager master-data-management mdm online-shop pim pimcore product-information-management product-management shop wcms

Affected surfaces

auth rbac

Summary

AI summary

Fix workspace permission path-boundary matching to be index‑usable and prevent unintended database access in ReverseObjectRelation.

Full changelog

What's Changed

  • [Docs] Add Custom Dashboard Widgets extension guide by @xIrusux in https://github.com/pimcore/pimcore/pull/19247
  • [Bug]: Fix defaultValue cannot be set/is no longer set to null, causing unique index violation by @kingjia90 in https://github.com/pimcore/pimcore/pull/19254
  • Add explicit ORDER BY column allowlist to Redirect\Listing by @robertSt7 in https://github.com/pimcore/pimcore/pull/19262
  • Escape FieldCollection fieldname in DataObject Listing JOIN condition by @robertSt7 in https://github.com/pimcore/pimcore/pull/19266
  • Reject unwhitelisted filter properties in NotificationServiceFilterParser by @robertSt7 in https://github.com/pimcore/pimcore/pull/19267
  • Bind CSV export files to the requesting user in CustomReportController by @robertSt7 in https://github.com/pimcore/pimcore/pull/19269
  • Validate field-collection type in Listing::addFieldCollection() by @robertSt7 in https://github.com/pimcore/pimcore/pull/19272
  • Fix workspace permission path-boundary matching (and make it index-usable) by @mcop1 in https://github.com/pimcore/pimcore/pull/19273
  • Set owner classId by @morgannilsson in https://github.com/pimcore/pimcore/pull/19150
  • Add string return type to Twig/TokenParser/BlockParser and Twig/TokenParser/ManualBlockParser by @jdreesen in https://github.com/pimcore/pimcore/pull/18853
  • Fix/link-get-html-fallback by @IronSean in https://github.com/pimcore/pimcore/pull/19004
  • [Video field] isEqual returns false when poster = null by @BlackbitDevs in https://github.com/pimcore/pimcore/pull/18882
  • [Bug, EC] PEES-1217: TypeError: Cannot assign null to property Link::$string_property of type string when loading DataObject with Link field containing legacy null values #854 by @jcPimcore in https://github.com/pimcore/pimcore/pull/19283
  • [Bug] Prevent database access in ReverseObjectRelation by @astehlik in https://github.com/pimcore/pimcore/pull/19002
  • Fix SimpleBackendSearch Error 414 - Request-URI Too Large by @t-engl in https://github.com/pimcore/pimcore/pull/18955
  • [Bug]: Accept classification store key names that are not valid identifiers by @mcop1 in https://github.com/pimcore/pimcore/pull/19284

New Contributors

  • @xIrusux made their first contribution in https://github.com/pimcore/pimcore/pull/19247
  • @morgannilsson made their first contribution in https://github.com/pimcore/pimcore/pull/19150

Full Changelog: https://github.com/pimcore/pimcore/compare/v2026.2.3...v2026.2.4

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Pimcore

Get notified when new releases ship.

Sign up free

About Pimcore

Multi-channel experience and engagement management platform.

All releases →

Related context

Beta — feedback welcome: [email protected]