LoginSign Up
← Back to all sparks
P

Pimcore

MKT AUTO
Velocity5.0

Open-source data and experience management platform (PIM, MDM, DAM, CMS)

pimcore.com ↗

Nearly every release in this window carries security hardening — Pimcore is working through an injection sweep.

pim-damsecurity-hardeningsql-injectionbackport-branchesdeprecationsphp-symfony
◆Current state
Pimcore maintains two calendar-versioned lines in parallel, 2026.2.x and 2026.1.x, with fixes landing on the newer line and selectively backported. The content is dominated by input-validation work: explicit field allowlists on Custom Report updates, an ORDER BY column allowlist for redirect listings, rejection of unwhitelisted filter properties, escaped field names in DataObject JOIN conditions, hardened unserialize paths, and CSV exports bound to the requesting user. Feature work is thin by comparison — a CDN integration and a TemplateProviderInterface extension point in 2026.2.1.
◆Where it's heading
The pattern is a systematic pass over places where user input reaches SQL or deserialization, spread across releases rather than bundled into one advisory — Custom Reports alone are touched in three separate releases. Alongside it runs a slower cleanup of the v11 era: admin functions removed, admin translations deprecated, v11-specific workflows refactored to v12. A task in the most recent release adds backward-compatibility break detection to the project's own code review tooling, which reads as an attempt to keep that cleanup from breaking integrators unannounced.
◆Prediction
Expect the hardening sweep to keep producing small paired releases on both lines, with Custom Reports and listing filters the likely remaining targets, and further admin-layer removals as the v12 cleanup continues.

◆Recent moves

  1. 4d ago

    Custom Report allowlist and raw DB error suppression

    The hardening sweep reaches Custom Reports again: updates are restricted to an explicit field allowlist and raw database exception messages are no longer returned from column config. The release also adds backward-compatibility break detection to the project's code review tooling — a small sign that the v12 cleanup is being managed rather than just executed.

    View source ↗
  2. 11d ago

    Listing filters and exports get allowlists and ownership checks

    The densest security release in the window: an ORDER BY column allowlist on redirect listings, escaped field names in DataObject JOIN conditions, rejected unwhitelisted filter properties, and CSV exports bound to the user who requested them. Four separate places where request input reached a query or a file, closed in one release.

    View source ↗
  3. 25d ago

    Three small fixes including Unicode asset key normalization

    A three-fix patch: a return type correction, a missing method annotation, and Unicode normalization of asset keys so thumbnails survive folder moves. Routine work between the larger hardening releases.

    View source ↗
  4. 1mo ago

    Schema drift and localized-field fixes

    Bug fixes with no new surface: install.sql realigned with migrations to stop fresh and migrated schemas diverging, guards for missing objects in localized field blocks, and licensing and docs cleanup.

    View source ↗
  5. 1mo ago

    2026.1 branch receives the same fix set as 2026.2.2

    The older line's mirror of 2026.2.2, tagged two minutes later and carrying the same schema-drift and localized-field fixes plus an objectbrick relation condition. Evidence of the dual-line policy that makes this feed's release count look higher than its change count.

    View source ↗
  6. 1mo ago

    CDN integration, template provider hook, admin functions removed

    The one release here doing more than fixing: a CDN integration, a TemplateProviderInterface extension point on the controller data provider, and continued removal of admin functions with admin translations deprecated. The v11-to-v12 workflow refactor in the same release places it squarely in the modernization arc rather than the hardening one.

    View source ↗