Log in Start free

Vulnerability · Published Jul 9, 2026 · Assigned by GitHub_M

CVE-2026-55208Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes

High 7.7

In plain English

A high-severity SQL injection in pimcore from pimcore. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.4%top 64.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio. Prior to 2025.4.6 and 2026.1.6, an authenticated user can extract the admin password hash and other database content through time-based blind SQL injection in the DateFilter column key parameter. The POST /pimcore-studio/api/website-settings endpoint and other listing endpoints accept a columnFilters array where the key field is interpolated directly into SQL with manual backtick wrapping, allowing a backtick character to break out of quoting and append arbitrary SQL such as SLEEP() and IF() subqueries. This issue is fixed in versions 2025.4.6 and 2026.1.6.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistpimcore/studio-backend-bundle2025.4.6GHSA-79cw-hfcc-7mw9
Packagistpimcore/studio-backend-bundle2026.1.6GHSA-79cw-hfcc-7mw9

Affected products (as reported)

VendorProductVersions
pimcore pimcore >= 2026.1.0, < 2026.1.6< 2025.4.6

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References