CVE-2026-55208 Details
Description
Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio. Prior to 2025.4.6 and 2026.1.6, an authenticated user can extract the admin password hash and other database content through time-based blind SQL injection in the DateFilter column key parameter. The POST /pimcore-studio/api/website-settings endpoint and other listing endpoints accept a columnFilters array where the key field is interpolated directly into SQL with manual backtick wrapping, allowing a backtick character to break out of quoting and append arbitrary SQL such as SLEEP() and IF() subqueries. This issue is fixed in versions 2025.4.6 and 2026.1.6.
A time-based blind SQL injection vulnerability has been identified in the Pimcore Studio Backend Bundle, affecting versions prior to 2025.4.6 and 2026.1.6. The vulnerability allows authenticated users to extract admin password hashes and other database content by injecting arbitrary SQL into the DateFilter column key parameter. This exploitation occurs through the POST /pimcore-studio/api/website-settings endpoint, as well as 11 other listing endpoints that use the DateFilter. The vulnerability arises because the column key is directly interpolated into the SQL query without proper validation, allowing attackers to break out of the backtick quoting and append malicious SQL payloads.
Users can update to Pimcore Studio Backend Bundle versions 2025.4.6 or 2026.1.6, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 9, 2026CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pimcore/pimcore/security/advisories/GHSA-79cw-hfcc-7mw9 | CISA-ADP | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/pimcore/pimcore/security/advisories/GHSA-79cw-hfcc-7mw9 | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://github.com/pimcore/studio-backend-bundle/commit/f532428cfbf4f5d6e299a13cedd5c29541802552 | [email protected] | Source CodeVendor |
| https://github.com/pimcore/studio-backend-bundle/pull/1883 | [email protected] | Issue TrackingVendor |
| https://github.com/pimcore/studio-backend-bundle/releases/tag/v2025.4.6 | [email protected] | Release NotesVendor |
| https://github.com/pimcore/studio-backend-bundle/releases/tag/v2026.1.6 | [email protected] | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Pimcore Studio Backend Bundle | <= 2026.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | New CVE Received | [email protected] |