Package Health/pimcore/studio-backend-bundle

pimcore/studio-backend-bundle

The license is explicit, installation has no lifecycle scripts, and the release includes detailed notes. Pin workflow actions before relying on this package in a production build.

Latest v2026.3.1

Packagist

86%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

100

Supply Chain

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

The audit covered all 16 workflows with no failed files or untrusted-checkout/script-injection findings, but all 22 action references are unpinned and three reusable workflows have high-confidence secrets-inherit findings; one workflow also grants top-level write access.

Vulnerabilities

Title	Versions	Severity
CVE-2026-55212 pimcore/studio-backend-bundle is vulnerable to Improper Input Validation in versions 0.0.0 - 2025.4.6 and 2026.1.0 - 2026.1.6.	0.0.0 - 2025.4.62026.1.0 - 2026.1.6	High
CVE-2026-55208 pimcore/studio-backend-bundle is vulnerable to Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in versions 0.0.0 - 2025.4.6 and 2026.1.0 - 2026.1.6.	0.0.0 - 2025.4.62026.1.0 - 2026.1.6	High
CVE-2026-55207 pimcore/studio-backend-bundle is vulnerable to Weak Password Recovery Mechanism for Forgotten Password in versions 0.0.0 - 2025.4.6 and 2026.1.0 - 2026.1.6.	0.0.0 - 2025.4.62026.1.0 - 2026.1.6	High

Package versions

Maintainers

No maintainer information available.

Direct Dependencies

Dependency	Last Release	Score
league/csv Version ^9.27	—	—
lcobucci/jwt Version ^5.3	—	—
symfony/lock Version ^7.4	—	—
nesbot/carbon Version ^3.10.0	—	—
pimcore/pimcore Version ^2026.3	—	—