AIKIDO-2026-84098

TL;DR

Reusable SelectOptions (enum) definitions use a configured identifier to build an on-disk PHP class file path and the generated class source, without restricting that identifier to a strict character set. A backend user who supplies a crafted identifier can inject PHP into the generated class file, control the class file path, or insert ALTER TABLE DDL into the DataObject store schema. When an object of the affected class is loaded, the injected PHP runs, leading to remote code execution and SQL injection against the DataObject tables. The fix validates identifiers with ^[A-Z][a-zA-Z0-9]+\z so the whole value must be a valid identifier.