Studio backend bundle: Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes (CVE-2026-55208)

The Pimcore Studio backend bundle contains a SQL injection vulnerability (CVE-2026-55208) in the DateFilter column key parameter used in the POST /pimcore-studio/api/website-settings endpoint and other listing endpoints. The vulnerability arises because user-controlled column keys are manually wrapped in backticks without escaping internal backticks, allowing attackers to break out of the quoting and inject arbitrary SQL, including time-based functions like SLEEP() for blind data extraction. The fixed named parameters (:minTime, :maxTime) used in the DateFilter bypass PDO's named parameter validation, making this injection possible. Other filters like EqualsFilter and LikeFilter are not exploitable due to stricter PDO parameter naming requirements. The vulnerability was confirmed on Pimcore 12.x (2026.x branch) with MariaDB 10.11 and PHP 8.4. Safe coding patterns exist elsewhere in the codebase using proper identifier quoting and allowlisting. The vulnerability is tracked as CWE-89 and has a CVSS 3.1 score of 7.7 (high severity).

An authenticated attacker can exploit this vulnerability to perform blind SQL injection attacks, enabling extraction of arbitrary database content, including sensitive data such as admin password hashes. The injection allows execution of arbitrary SQL commands within the database context, potentially compromising confidentiality. The vulnerability does not affect integrity or availability directly but poses a significant risk to data confidentiality.

A patch is available for this vulnerability. Users should upgrade to a fixed version of the Pimcore Studio backend bundle to remediate the issue. Avoid using vulnerable versions prior to 2025.4.6 and between 2026.1.0 and 2026.1.6. The vendor advisory or patch notes should be consulted for the exact fixed versions. Until patched, restrict access to authenticated users and monitor for suspicious activity related to the affected endpoints.