CVE-2026-55416 Details
Description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reports_config permission can place attacker-controlled SQL fragments in the sql, from, where, and groupby fields of a Custom Reports configuration processed by bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php. The buildQueryString() method concatenates these values into a database query, while a blacklist omits dangerous constructs such as additional data-manipulation statements, comments, subqueries, and multiple statements. The getData() method also previously interpolated offset and limit values into a LIMIT clause without integer casting. Executing the configured report reaches fetchAllAssociative() with the constructed query and can disclose, modify, or delete arbitrary database data. This issue is fixed in versions 11.5.19, 12.3.10, and 2026.1.6.
A SQL injection vulnerability has been identified in the Pimcore Custom Reports bundle, affecting versions prior to 11.5.19, 12.3.10, and 2026.1.6. The issue arises in the 'Sql.php' file, specifically within the 'buildQueryString()' method, which concatenates user-controlled SQL fragments from the report configuration into database queries without proper parameterization. Although there is a blacklist to filter out certain SQL commands and comments, it can be easily bypassed, allowing an authenticated user with 'reports_config' permission to inject malicious SQL that could be executed against the database. This exploitation could lead to unauthorized reading, modification, or deletion of database data.
Users should update to Pimcore versions 11.5.19, 12.3.10, or 2026.1.6. Until the update is applied, it is recommended to restrict 'reports_config' permission to trusted administrators and deploy a Web Application Firewall (WAF) rule to block requests containing SQL keywords in the 'configuration' parameter.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pimcore/pimcore/commit/1999fee27ed0d027ad5b8195ecf6e27243729530 | [email protected] | Source CodeVendor |
| https://github.com/pimcore/pimcore/pull/19175 | [email protected] | Source CodeVendor |
| https://github.com/pimcore/pimcore/releases/tag/v12.3.10 | [email protected] | Release NotesVendor |
| https://github.com/pimcore/pimcore/releases/tag/v2026.1.6 | [email protected] | Release NotesVendor |
| https://github.com/pimcore/pimcore/security/advisories/GHSA-23rh-xw42-fq82 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Pimcore | <= 2026.1.5 (semver) <= 12.3.9 (semver) <= 11.5.18 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |