Packagist / PACKAGE INTELLIGENCE

pimcore/studio-backend-bundle

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

high7.7

GHSA-79cw-hfcc-7mw9Fix available

Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes

Packagist / pimcore/studio-backend-bundle

28 Aug

pimcore/studio-backend-bundle Packagist

Ecosystem versions

Earlier releases before 2025.4.6

Fixed in 2025.4.6

16 explicitly affected versions

v0.10.21, v0.12.18, v0.12.9, v0.13.20, v0.14.19, v0.15.17, v0.4.30, v0.5.20, v0.6.30, v0.9.30, v2025.4.0, v2025.4.1, v2025.4.2, v2025.4.3, v2025.4.4, v2025.4.5

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "2025.4.6"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v0.10.21",
    "v0.12.18",
    "v0.12.9",
    "v0.13.20",
    "v0.14.19",
    "v0.15.17",
    "v0.4.30",
    "v0.5.20",
    "v0.6.30",
    "v0.9.30",
    "v2025.4.0",
    "v2025.4.1",
    "v2025.4.2",
    "v2025.4.3",
    "v2025.4.4",
    "v2025.4.5"
  ]
}

pimcore/studio-backend-bundle Packagist

Ecosystem versions

From 2026.1.0 before 2026.1.6

Fixed in 2026.1.6

6 explicitly affected versions

v2026.1.0, v2026.1.1, v2026.1.2, v2026.1.3, v2026.1.4, v2026.1.5

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "2026.1.0"
        },
        {
          "fixed": "2026.1.6"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v2026.1.0",
    "v2026.1.1",
    "v2026.1.2",
    "v2026.1.3",
    "v2026.1.4",
    "v2026.1.5"
  ]
}

high8.8

GHSA-h854-c3m3-mh5vFix available

Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass

Packagist / pimcore/studio-backend-bundle

28 Aug

pimcore/studio-backend-bundle Packagist

Ecosystem versions

Earlier releases before 2025.4.6

Fixed in 2025.4.6

16 explicitly affected versions

v0.10.21, v0.12.18, v0.12.9, v0.13.20, v0.14.19, v0.15.17, v0.4.30, v0.5.20, v0.6.30, v0.9.30, v2025.4.0, v2025.4.1, v2025.4.2, v2025.4.3, v2025.4.4, v2025.4.5

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "2025.4.6"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v0.10.21",
    "v0.12.18",
    "v0.12.9",
    "v0.13.20",
    "v0.14.19",
    "v0.15.17",
    "v0.4.30",
    "v0.5.20",
    "v0.6.30",
    "v0.9.30",
    "v2025.4.0",
    "v2025.4.1",
    "v2025.4.2",
    "v2025.4.3",
    "v2025.4.4",
    "v2025.4.5"
  ]
}

pimcore/studio-backend-bundle Packagist

Ecosystem versions

From 2026.1.0 before 2026.1.6

Fixed in 2026.1.6

6 explicitly affected versions

v2026.1.0, v2026.1.1, v2026.1.2, v2026.1.3, v2026.1.4, v2026.1.5

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "2026.1.0"
        },
        {
          "fixed": "2026.1.6"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v2026.1.0",
    "v2026.1.1",
    "v2026.1.2",
    "v2026.1.3",
    "v2026.1.4",
    "v2026.1.5"
  ]
}