CVE-2026-55208
1 advisory.
Packagist/pimcore/studio-backend-bundle CVE-2026-55208: high 7.7
Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes
Action: Upgrade pimcore/studio-backend-bundle to 2025.4.6 or later.
composer require pimcore/studio-backend-bundle:2025.4.6composer require pimcore/studio-backend-bundle:2026.1.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2025.4.6 | - |
| 2026.1.0 | 2026.1.6 | - |
Fixed versions
| 2025.4.6 | 2026.1.6 |
Sources
- osv: GHSA-79cw-hfcc-7mw9
- https://github.com/pimcore/pimcore/security/advisories/GHSA-79cw-hfcc-7mw9
- https://nvd.nist.gov/vuln/detail/CVE-2026-55208
- https://github.com/pimcore/studio-backend-bundle/pull/1883
- https://github.com/pimcore/studio-backend-bundle/commit/f532428cfbf4f5d6e299a13cedd5c29541802552
- https://github.com/pimcore/pimcore
- https://github.com/pimcore/studio-backend-bundle/releases/tag/v2025.4.6
- https://github.com/pimcore/studio-backend-bundle/releases/tag/v2026.1.6
CVE-2026-55208 · published · modified · JSON