CVE-2026-55084 Details
Description
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the `filter` parameter used by the `/api/sqlViews/{viewId}/data.json` endpoint. An authenticated user with access to a SqlView can inject arbitrary SQL queries inside the `filter` parameter by abusing an expression executed by PostgreSQL and its output is reflected inside the application error message. This behavior enables attackers to extract arbitrary database content using error-based SQL injection. Affected versions include: 2.37, 2.38, 2.39, 2.40.x before 2.40.11.1/2.40.12, 2.41.x before 2.41.8.2, 2.42.x before 2.42.5.1, 2.43.0 before 2.43.0.1, 2.44 development branch before PR #24162 Patched versions include: 2.37-EOS (2026-06-09), 2.38-EOS (2026-06-09), 2.39-EOS (2026-06-09), 2.40.11.1, 2.40.12, 2.41.8.2, 2.42.5.1, 2.43.0.1, 2.44 development branch after PR #24162
A SQL injection vulnerability has been identified in the SqlView API endpoint of the DHIS2 application, specifically in the 'filter' parameter used by the '/api/sqlViews/{viewId}/data.json' endpoint. This vulnerability allows authenticated users with access to a SqlView to inject arbitrary SQL queries, exploiting an expression executed by PostgreSQL. The injection's output is reflected in the application error message, enabling attackers to extract sensitive database content through error-based SQL injection.
Users can upgrade to DHIS2 versions 2.37-EOS, 2.38-EOS, 2.39-EOS, 2.40.11.1, 2.40.12, 2.41.8.2, 2.42.5.1, 2.43.0.1, or the 2.44 development branch after PR #24162.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 21, 2026CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dhis2/dhis2-core/pull/24162 | [email protected] | Source CodeVendor |
| https://github.com/dhis2/dhis2-core/security/advisories/GHSA-pwmg-mvjw-4m23 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DHIS2 | 2.37 2.38 2.39 2.40.x < 2.40.11.1 2.40.x < 2.40.12 2.41.x < 2.41.8.2 2.42.x < 2.42.5.1 2.43.0 < 2.43.0.1 2.44 development branch < PR #24162 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |