CVE-2026-55208: SQL Injection in Pimcore Studio Backend Bundle—Admin Password Extraction

Technical summary

The vulnerability is a time-based blind SQL injection in the DateFilter column key parameter across multiple listing endpoints, notably the POST /pimcore-studio/api/website-settings endpoint. The columnFilters array's key field undergoes manual backtick wrapping rather than parameterized query handling, permitting a backtick character to escape the quoting context. An authenticated attacker can append malicious SQL subqueries using SLEEP() for timing-based detection and IF() conditionals to extract data bit-by-bit from the database. The root cause is insufficient input validation and reliance on string concatenation for query construction instead of prepared statements.

Business impact

Compromise of administrator credentials represents a critical business risk, as attackers gaining admin access can modify website content, alter business logic, access customer data, and establish persistent footholds within the infrastructure. Data exfiltration from the backend database could expose customer information, transaction records, and proprietary business data. While the vulnerability requires prior authentication, insider threats or credential compromise elsewhere in the environment could be the initial vector. The impact extends beyond the Pimcore instance itself when that instance manages critical business workflows or hosts sensitive customer information.

Affected systems

Pimcore Studio Backend Bundle versions prior to 2025.4.6 (in the 2025.4.x release line) and prior to 2026.1.6 (in the 2026.1.x release line) are affected. Organizations running earlier versions of these release lines face exposure. The vulnerability affects all instances where the backend bundle is deployed and accessible to authenticated users, particularly those exposed to internal network users or where authentication controls may be weaker.

Exploitability

Exploitation requires valid authentication credentials, which reduces the attack surface compared to unauthenticated vulnerabilities but does not eliminate the risk. Time-based blind SQL injection is relatively straightforward to execute with automated tools once the injection point is identified; no complex exploitation technique or race conditions are needed. The POST endpoints are standard REST API calls, making them easily accessible to anyone with API credentials. An attacker with legitimate but low-privileged user access could extract the admin password hash and escalate privileges. The vulnerability is not listed on CISA's KEV (Known Exploited Vulnerabilities) catalog as of the last update, suggesting no active in-the-wild exploitation has been formally documented, though this does not guarantee safety.

Remediation

Immediate patching is the primary remediation. Upgrade Pimcore Studio Backend Bundle to version 2025.4.6 or later (for 2025.4.x users) or to version 2026.1.6 or later (for 2026.1.x users). Verify patch deployment and test functionality in a staging environment before production rollout. Until patching is complete, restrict API access to the /pimcore-studio/api endpoints to trusted networks or users, and monitor authentication logs for suspicious activity. Review recent access logs to identify whether the vulnerability may have been exploited. Conduct a password reset for administrative accounts as a precautionary measure if exposure cannot be ruled out.

Patch guidance

Check your current Pimcore Studio Backend Bundle version and compare it against the fixed versions: 2025.4.6 and 2026.1.6. If your installation is on the 2025.4.x branch, update to 2025.4.6 or later. If on the 2026.1.x branch, update to 2026.1.6 or later. Consult the official Pimcore release notes and security advisories to confirm any additional steps required during the upgrade, such as database migrations or cache clearing. Test the patch in a non-production environment to ensure compatibility with your custom extensions or configurations before deploying to production.

Detection guidance

Monitor for POST requests to /pimcore-studio/api/website-settings and other listing endpoints that include suspicious characters (particularly backticks) in the columnFilters key parameter. Look for repeated requests with time-delay payloads, which are characteristic of blind SQL injection attempts. Enable query logging on your database backend to capture slow queries or unusual subqueries involving SLEEP() or IF() functions. Check web application firewall (WAF) logs for blocked requests containing SQL keywords in API parameters. Review database access logs for queries initiated by the Pimcore application user that deviate from normal patterns or attempt to enumerate system tables.

Why prioritize this

This vulnerability scores 7.7 (HIGH) on CVSS 3.1 and warrants prompt attention because it enables direct extraction of administrative credentials, the most critical database content in any web application. Although authentication is required, the ease of exploitation and the severity of the impact (admin account compromise) place it in the immediate-remediation category. Organizations running affected versions should prioritize patching within days rather than weeks, particularly if the Pimcore instance manages customer-facing services or sensitive data.

Risk score, explained

The CVSS 3.1 score of 7.7 reflects a HIGH-severity vulnerability with network-accessible endpoints (AV:N), low attack complexity (AC:L), and requirement for low privileges (PR:L). The scope changes when compromised (S:C), and confidentiality impact is high (C:H) due to unrestricted database content extraction. No integrity or availability impact is scored, as SQL injection here does not modify data or crash the service; it only exfiltrates information. The score appropriately captures the threat: while not a complete system compromise, extraction of admin hashes and sensitive data poses severe business and security consequences.

Frequently asked questions