SQL injection in pimcore
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.
Summary
Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio. Prior to 2025.4.6 and 2026.1.6, an authenticated user can extract the admin password hash and other database content through time-based blind SQL injection in the DateFilter column key parameter. The POST /pimcore-studio/api/website-settings endpoint and other listing endpoints accept a columnFilters array where the key field is interpolated directly into SQL with manual backtick wrapping, allowing a backtick character to break out of quoting and append arbitrary SQL such as SLEEP() and IF() subqueries. This issue is fixed in versions 2025.4.6 and 2026.1.6.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pimcore | pimcore | 2026.1.0 to before 2026.1.6; before 2025.4.6 | 2026.1.6, 2025.4.6 | Patch available | CNA |
| — | pimcore/studio-backend-bundle (Packagist) | before 2025.4.6 | 2025.4.6 | Patch available | GHSA-79cw-hfcc-7mw9 |
| — | pimcore/studio-backend-bundle (Packagist) | 2026.1.0 to before 2026.1.6 | 2026.1.6 | Patch available | GHSA-79cw-hfcc-7mw9 |
- pimcore Vendorpimcore Affected 2026.1.0 to before 2026.1.6; before 2025.4.6 Fixed in 2026.1.6, 2025.4.6 Patch available CNA
- pimcore/studio-backend-bundle (Packagist) Vendor— Affected before 2025.4.6 Fixed in 2025.4.6 Patch available GHSA-79cw-hfcc-7mw9
- pimcore/studio-backend-bundle (Packagist) Vendor— Affected 2026.1.0 to before 2026.1.6 Fixed in 2026.1.6 Patch available GHSA-79cw-hfcc-7mw9
Remediation
- Fix · CNA pimcore (pimcore) Fixed in 2026.1.6, 2025.4.6
- Fix · GHSA-79cw-hfcc-7mw9 pimcore/studio-backend-bundle (Packagist) Fixed in 2025.4.6 Advisory →
- Fix · GHSA-79cw-hfcc-7mw9 pimcore/studio-backend-bundle (Packagist) Fixed in 2026.1.6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55208
- 2026-10-03 Alias added: GHSA-79cw-hfcc-7mw9
References
Other 6
- https://github.com/pimcore/pimcore/security/advisories/GHSA-79cw-hfcc-7mw9
- https://github.com/pimcore/studio-backend-bundle/pull/1883
- https://github.com/pimcore/studio-backend-bundle/commit/f532428cfbf4f5d6e299a13cedd5c29541802552
- https://github.com/pimcore/studio-backend-bundle/releases/tag/v2025.4.6
- https://github.com/pimcore/studio-backend-bundle/releases/tag/v2026.1.6
- https://github.com/pimcore/pimcore
More pimcore vulnerabilities
- TI-2026-18925 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848 CVSS 3.1HIGH 8.8
- TI-2024-15667 Pimcore Admin Classic Bundle host header injection in the password reset CVSS 3.1HIGH 8.8
- TI-2026-40161 Pimcore: Remote Code Execution via DataObject Class-Definition Field Name CVSS 3.1CRITICAL 9.9
- TI-2026-18926 Pimcore ENV Variables and Cookie Informations are exposed in http_error_log CVSS 3.1HIGH 8.6
- TI-2024-16853 Pimcore Host Header Injection in user invitation link CVSS 3.1CRITICAL 9.3
- TI-2023-01489 SQL Injection in pimcore/pimcore CVSS 3.1HIGH 8.8
Sources
- CVE-2026-55208 · CVE Program
- CVE-2026-55208 · NVD
- FIRST EPSS
- GHSA-79cw-hfcc-7mw9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences