CVE-2026-55208: Pimcore Studio Backend Bundle SQL injection in DateFilter

CVE-2026-55208 · Severity: high · CVSS 7.7 · Published 2026-07-09

Pimcore, a popular open-source PIM and CMS platform, contains a SQL injection vulnerability in its listing filter API that allows authenticated users to extract sensitive database contents including admin password hashes. An attacker with access to listing endpoints can bypass insufficient input validation by injecting SQL metacharacters into column filter parameters, enabling time-based data exfiltration. This compromises confidentiality of all database records and enables account takeover via password recovery tokens.

Technologies: pimcore/studio-backend-bundle (Packagist), Pimcore, Pimcore Studio Backend Bundle. Vendors: Packagist, Pimcore.

Quick answers

Is CVE-2026-55208 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55208 being exploited in the wild.
How severe is CVE-2026-55208?
High severity, with a CVSS score of 7.7, published 9 July 2026.
Which products and versions are affected?
pimcore/studio-backend-bundle (Packagist) ECOSYSTEM:introduced=0,fixed=2025.4.6; Pimcore < 2025.4.6, >= 2026.1.0 and < 2026.1.6; Pimcore Studio Backend Bundle < 2025.4.6, >= 2026.1.0 < 2026.1.6, < 2025.4.6, >= 2026.1.0 and < 2026.1.6.
Is there a fix for CVE-2026-55208?
Yes. pimcore/studio-backend-bundle (Packagist): upgrade to 2025.4.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55208 attacked?
It is attacked over the network.
Am I affected by CVE-2026-55208?
Check whether you run pimcore/studio-backend-bundle (Packagist), Pimcore or Pimcore Studio Backend Bundle at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • pimcore/studio-backend-bundle (Packagist): upgrade to 2025.4.6 or later
    composer require pimcore/studio-backend-bundle:^2025.4.6

Technical details

The vulnerability exists in `src/Listing/Filter/DateFilter.php` and `src/Note/Service/FilterService.php`, where user-supplied column names from the `columnFilters[].key` parameter are concatenated directly into SQL BETWEEN clauses using only simple backtick wrapping: `` '`' . $key . '`' ``. Unlike the safe `quoteIdentifier()` method used elsewhere in the codebase (which doubles internal backticks), manual wrapping does not escape embedded backtick characters. An attacker can inject a backtick followed by SQL injection payload (e.g., `id` BETWEEN 0 AND 99999999999) AND SLEEP(3)-- `) to break out of the identifier quoting and inject arbitrary SQL. The attack is enabled because DateFilter uses fixed, hardcoded parameter names (`:minTime`, `:maxTime`) rather than the column name itself as the parameter, bypassing PDO validation. Precondition: the attacker must be authenticated and have access to at least one listing endpoint supporting DateFilter on clause (12+ endpoints affected). Impact: full database read access via time-based blind SQLi, extractable data includes user password hashes, password recovery tokens, and all PIM/CMS content. Patches available in versions 2025.4.6 and 2026.1.6+.

Affected products

  • Pimcore Pimcore < 2025.4.6, >= 2026.1.0 and < 2026.1.6
  • Pimcore studio-backend-bundle < 2025.4.6, >= 2026.1.0 and < 2026.1.6

Identifiers

  • CVE-2026-55208
  • GHSA-79cw-hfcc-7mw9

Timeline

  • 2026-06-29: disclosed: GitHub Advisory published
  • 2026-08-28: advisory: Advisory updated with additional details
  • 2026-06-29: patched: Patches released in versions 2025.4.6 and 2026.1.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.