CVE-2026-55072

### Summary A missing end anchor (`$`) in the ClassDefinition UID validation regex allows an authenticated user with the `objects` permission to create a class with a malicious UID containing SQL. When a data object of that class is later loaded, Block.php concatenates the raw classId directly into a SQL query without quoting, executing the injected payload. This is an incomplete fix from commit `dbe1d131e4` which added a leading `^` anchor but omitted the trailing `$`. ### Details ### 1. Missing end anchor in ClassDefinition UID validation `models/DataObject/ClassDefinition.php` lines 1148-1154: ```php if (!preg_match('/^[a-zA-Z]\w+/', $this->getName())) { throw new Exception(sprintf('Invalid name for class definition: %s', $this->getName())); } if (!preg_match('/^[a-zA-Z0-9]([a-zA-Z0-9_]+)?/', $this->getId())) { throw new Exception(sprintf('Invalid ID `%s` for class definition %s', $this->getId(), $this->getName())); } ``` Both patterns are missing a trailing `$` anchor. Without it, `preg_match` only checks that the string STARTS with a valid identifier — it does not assert end-of-string. A UID of `1 UNION SELECT password FROM users-- ` passes because the regex matches `1` at the start and ignores the rest. Compare with the correct pattern used by Fieldcollection in `models/DataObject/Fieldcollection/Definition.php` line 268: ```php if (!preg_match('/^[a-zA-Z]\w*$/', $key)) { // has $ — correct return true; } ``` ### 3. Unquoted classId concatenation in Block.php `models/DataObject/ClassDefinition/Data/Block.php` line 735: ```php $query = 'select ' . $db->quoteIdentifier($field) . ' from object_store_' . $object->getClassId() . ' where oo_id = ' . $object->getId(); ``` `$object->getClassId()` returns the raw stored classId with no quoting. This same unquoted pattern repeats on lines 744, 746, 748, 759, and 771 for objectbrick, fieldcollection, and localized field contexts. Compare with `models/DataObject/ClassDefinition/Dao.php` line 10