CVE-2026-55416

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reports_config permission can place attacker-controlled SQL fragments in the sql, from, where, and groupby fields of a Custom Reports configuration processed by bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php. The buildQueryString() method concatenates these values into a database query, while a blacklist omits dangerous constructs such as additional data-manipulation statements, comments, subqueries, and multiple statements. The getData() method also previously interpolated offset and limit values into a LIMIT clause without integer casting. Executing the configured report reaches fetchAllAssociative() with the constructed query and can disclose, modify, or delete arbitrary database data. This issue is fixed in versions 11.5.19, 12.3.10, and 2026.1.6.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/pimcore/pimcore/commit/1999fee27ed0d027ad5b8195ecf6e27243729530
https://github.com/pimcore/pimcore/pull/19175
https://github.com/pimcore/pimcore/releases/tag/v12.3.10
https://github.com/pimcore/pimcore/releases/tag/v2026.1.6
https://github.com/pimcore/pimcore/security/advisories/GHSA-23rh-xw42-fq82

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-14 17:17

Updated : 2026-09-16 13:42

NVD link : CVE-2026-55416

Mitre link : CVE-2026-55416

CVE.ORG link : CVE-2026-55416

JSON object : View

Products Affected

No product.

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-55416", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55416", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-14T19:21:25.545251Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "pimcore", "product": "pimcore", "versions": [{"status": "affected", "version": "< 11.5.19"}, {"status": "affected", "version": ">= 12.0.0, < 12.3.10"}, {"status": "affected", "version": ">= 2026.1.0, < 2026.1.6"}]}]}], "published": "2026-09-14T17:17:48.220", "references": [{"url": "https://github.com/pimcore/pimcore/commit/1999fee27ed0d027ad5b8195ecf6e27243729530", "source": "security-advisories@github.com"}, {"url": "https://github.com/pimcore/pimcore/pull/19175", "source": "security-advisories@github.com"}, {"url": "https://github.com/pimcore/pimcore/releases/tag/v12.3.10", "source": "security-advisories@github.com"}, {"url": "https://github.com/pimcore/pimcore/releases/tag/v2026.1.6", "source": "security-advisories@github.com"}, {"url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-23rh-xw42-fq82", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reports_config permission can place attacker-controlled SQL fragments in the sql, from, where, and groupby fields of a Custom Reports configuration processed by bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php. The buildQueryString() method concatenates these values into a database query, while a blacklist omits dangerous constructs such as additional data-manipulation statements, comments, subqueries, and multiple statements. The getData() method also previously interpolated offset and limit values into a LIMIT clause without integer casting. Executing the configured report reaches fetchAllAssociative() with the constructed query and can disclose, modify, or delete arbitrary database data. This issue is fixed in versions 11.5.19, 12.3.10, and 2026.1.6."}], "lastModified": "2026-09-16T13:42:48.827", "sourceIdentifier": "security-advisories@github.com"}