CVE-2026-55208

Name of the Vulnerable Software and Affected Versions Pimcore Studio Backend Bundle versions prior to 2025.4.6 Pimcore Studio Backend Bundle versions prior to 2026.1.6

Description An authenticated user can extract the admin password hash and other database content via time-based blind SQL injection. This occurs because the columnFilters array in the 'POST /pimcore-studio/api/website-settings' endpoint and other listing endpoints allows the DateFilter column key parameter to be interpolated directly into SQL. By using a backtick character, an attacker can break out of the quoting and append arbitrary SQL subqueries, such as SLEEP() and IF(). Time-based blind SQL injection is a technique used to infer data from a database by observing the time it takes for the server to respond to specific queries.

Recommendations Update Pimcore Studio Backend Bundle to version 2025.4.6. Update Pimcore Studio Backend Bundle to version 2026.1.6.