What is the CVSS score of EUVD-2026-42696?

EUVD-2026-42696 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Pimcore Studio are affected by EUVD-2026-42696?

Pimcore Studio Backend Bundle versions 2025.4.6 and earlier, 2026.1.6 and earlier, contain a time-based blind SQL injection vulnerability allowing authenticated low-privilege users to read entire…. A patch is available.

How to fix or mitigate EUVD-2026-42696?

Within 24 hours: inventory all systems running Pimcore Studio Backend Bundle; audit access logs for suspicious queries or anomalous POST traffic to /pimcore-studio/api/website-settings and related listing endpoints. Within 7 days: implement Web Application Firewall (WAF) rules to block SQL injection patterns in dateFilter and columnFilters parameters; enable database query audit logging focused on the /pimcore-studio API path. Within 30 days: monitor Pimcore security advisories for patch availability targeting versions 2025.4.6, 2026.1.6 or later; evaluate upgrading to patched versions or implementing compensating database-level access controls.

Pimcore Studio EUVD-2026-42696

| CVE-2026-55208 HIGH

SQL Injection (CWE-89)

2026-07-09 security-advisories@github.com

GHSA-79cw-hfcc-7mw9

SQLi

7.7

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable, low-complexity blind SQLi requires an authenticated low-priv account (PR:L) and reads arbitrary DB data (C:H); no write/DoS shown (I/A:N); impact stays within the database, so S:U rather than vendor's S:C.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 09, 2026 - 22:01 EUVD

Analysis Generated

Jul 09, 2026 - 21:40 vuln.today

DescriptionCVE.org

Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio. Prior to 2025.4.6 and 2026.1.6, an authenticated user can extract the admin password hash and other database content through time-based blind SQL injection in the DateFilter column key parameter. The POST /pimcore-studio/api/website-settings endpoint and other listing endpoints accept a columnFilters array where the key field is interpolated directly into SQL with manual backtick wrapping, allowing a backtick character to break out of quoting and append arbitrary SQL such as SLEEP() and IF() subqueries. This issue is fixed in versions 2025.4.6 and 2026.1.6.

AnalysisAI

Time-based blind SQL injection in Pimcore Studio Backend Bundle (before 2025.4.6 and 2026.1.6) lets an authenticated low-privilege user read arbitrary database contents, including the administrator password hash, via the DateFilter column key parameter. The POST /pimcore-studio/api/website-settings endpoint and other listing endpoints interpolate the columnFilters key field directly into SQL with manual backtick wrapping, so a backtick breaks out of quoting to append SLEEP()/IF() subqueries. No public exploit identified at time of analysis; not listed in CISA KEV and no EPSS score supplied.

Technical ContextAI

The affected component is the Pimcore Studio Backend Bundle, the PHP/Symfony backend for Pimcore's newer Studio administration UI, part of the broader Pimcore open-source DXP/PIM/CMS platform. The root cause is CWE-89 (SQL Injection): the listing/filter layer builds queries by manually wrapping the user-supplied column key in backticks and concatenating it into the SQL string rather than using parameterized queries or an allow-list of column identifiers. Because a backtick supplied in the key terminates the identifier quoting, an attacker can append conditional, time-delayed subqueries (SLEEP/IF), turning a filter field into a blind boolean/time oracle that exfiltrates data such as password hashes one bit at a time.

RemediationAI

Vendor-released patch: upgrade studio-backend-bundle to 2025.4.6 (for 2025.4.x deployments) or 2026.1.6 (for 2026.1.x deployments); the fix is delivered in commit f532428cfbf4f5d6e299a13cedd5c29541802552 via pull request https://github.com/pimcore/studio-backend-bundle/pull/1883 and documented in advisory https://github.com/pimcore/pimcore/security/advisories/GHSA-79cw-hfcc-7mw9. If immediate patching is not possible, reduce exposure by restricting who holds authenticated Studio accounts and revoking listing/filter access from low-trust users, and place the /pimcore-studio/api/ endpoints behind network or WAF controls that block backtick and SLEEP()/IF() patterns in columnFilters key values - noting that WAF rules on blind injection are easily bypassed and may break legitimate filters, so they are a stopgap only. Because the extracted asset is the admin password hash, rotate admin credentials and enforce strong, unique passwords after patching in case exposure already occurred.