CVE-2026-44739 Details
Description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, the columnConfigAction endpoint in bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php passes malicious SQL configuration through CustomReportController:columnConfigAction, SqlAdapter::getColumns, SqlAdapter::buildQueryString, and Db::fetchAssociative(), allowing an attacker with the reports_config permission to use arbitrary SELECT queries, UNION statements, dangerous database functions, and error-based SQL injection to exfiltrate or manipulate database data. This issue is fixed in versions 11.5.17 (LTS) and 12.3.6.
A SQL injection vulnerability has been identified in the columnConfigAction endpoint of the CustomReportsBundle in Pimcore. This issue affects versions prior to 11.5.17 (LTS) and 12.3.6. The vulnerability allows an attacker with the reports_config permission to inject malicious SQL that is executed on the database. Although the application attempts to filter certain SQL keywords, it fails to prevent arbitrary SELECT queries and the use of dangerous database functions. The vulnerability could be exploited to exfiltrate or manipulate database data, particularly through error-based SQL injection techniques.
Users can upgrade to Pimcore versions 11.5.17 (LTS) or 12.3.6 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pimcore/pimcore/security/advisories/GHSA-3234-gxc3-pq6f | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/pimcore/pimcore/commit/3fd7733464f464e58ffa49ed91550c1a3f9535f2 | [email protected] | Source CodeVendor |
| https://github.com/pimcore/pimcore/pull/19098 | [email protected] | Source CodeVendor |
| https://github.com/pimcore/pimcore/releases/tag/v12.3.6 | [email protected] | Release NotesVendor |
| https://github.com/pimcore/pimcore/security/advisories/GHSA-3234-gxc3-pq6f | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Pimcore | <= 11.5.16 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 18, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |