[HIGH] Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

PKSA-fpxc-s2d8-24zv CVE-2026-55072 GHSA-2mhj-fhvg-v428

Affected package: pimcore/pimcore

Affected version: <12.3.9|>=2026.1.0,<=2026.1.4

Reported by:
GitHub