This CVE exposes a SQL injection in Pimcore's admin translation grid, where the property filter parameter — used to let admins sort by arbitrary columns — gets interpolated directly into a UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...))) expression. The developer wrote domain-specific SQL to handle timestamp filtering, got the feature working, and moved on. The assumption was likely either that the admin context provided implicit trust or that framework sanitization covered this non-standard data path. It didn't.
The critical insight is that this isn't just a forgotten feature. The translation grid is a cross-cutting utility that touches every translatable entity in a Pimcore installation — products, pages, assets, metadata. Compromising it doesn't give you a date filter exploit; it gives you a pivot into your entire multilingual data estate. This is the blast radius that the CVSS 8.8 captures but the 0.0035 EPSS score materially underweights, because EPSS models vulnerabilities in isolation, not the compounding risk of admin credential theft plus a force-multiplier injection.
The simultaneous fixes across Pimcore 1.7.x and 2.3.x tell you this code is old — likely predating major architectural refactors. It survived not because nobody cared, but because admin utilities enter maintenance stasis: they work, nobody touches them, and the 'admin-only' rationale provides psychological cover for skipping security review. The dual-branch fix pattern also means your patching priority depends on which release train you're on. If you're on 1.7.x, the 2.3.6 patch doesn't help you. Track both branches.
The fix is almost certainly either a strict allowlist for the property parameter or a move to parameterized queries. Either way, the architectural lesson is the same: authenticated admin context is a risk multiplier, not a security control. Admin interfaces concentrate access, which means vulnerabilities within them have systemic blast radius. Assume every query in admin code is a data flow requiring the same input hygiene as public-facing endpoints.