CVE-2026-55082 Details
Description
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticated users with SQL View access to provide crafted filter values that were interpolated into generated SQL. An authenticated user with access to SQL View execution could manipulate SQL generated for SQL View filters and potentially access data outside the intended SQL View result set. This is distinct from CVE-2026-55084, which tracks the related SQL View filter column-name injection. Known affected release lines for this advisory: DHIS2 2.37, 2.38, and 2.39 before the 2026-06-09 EOS security updates. Patched by the 2026-06-09 EOS security updates for 2.37, 2.38, and 2.39. The same value-slot hardening was already present on later supported branches through DHIS2-20174 / PR #22253.
A SQL injection vulnerability has been identified in DHIS2 versions 2.37, 2.38, and 2.39 prior to the 2026-06-09 EOS security updates. This vulnerability allows authenticated users with SQL View access to manipulate filter values, which are then interpolated into the generated SQL. As a result, these users could potentially access data outside the intended SQL View result set. The vulnerability arises from insufficient validation of crafted filter values in SQL View data endpoints.
Users can upgrade to the patched EOS build for the relevant release line. The fix incorporates parameter binding for filter values and identifier quoting for SQL View fields and criteria.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 21, 2026CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dhis2/dhis2-core/pull/22253 | [email protected] | Source CodeVendor |
| https://github.com/dhis2/dhis2-core/pull/24172 | [email protected] | Issue TrackingVendor |
| https://github.com/dhis2/dhis2-core/pull/24173 | [email protected] | Issue TrackingVendor |
| https://github.com/dhis2/dhis2-core/pull/24174 | [email protected] | Issue TrackingVendor |
| https://github.com/dhis2/dhis2-core/security/advisories/GHSA-3288-cm98-664f | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DHIS2 | 2.37 2.38 2.39 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |