CVE-2026-44739 Pimcore: SQL Injection in Custom Reports Column Configuration
An attacker with reports_config permission can execute arbitrary SQL queries to exfiltrate or manipulate database data in Pimcore.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-44739?
CVE-2026-44739 is a high-severity SQL injection vulnerability in pimcore, published on 17 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, the columnConfigAction endpoint in bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php passes malicious SQL configuration through CustomReportController:columnConfigAction, SqlAdapter::getColumns, SqlAdapter::buildQueryString, and Db::fetchAssociative(), allowing an attacker with the reports_config permission to use arbitrary SELECT queries, UNION statements, dangerous database functions, and error-based SQL injection to exfiltrate or manipulate database data. This issue is fixed in versions 11.5.17 (LTS) and 12.3.6.
Weakness: CWE-89
Which versions are affected by CVE-2026-44739?
6 open source packages ship an affected version, including pimcore/pimcore.
| Package | Affected | Fixed in |
|---|---|---|
pimcore/pimcore Packagist | All versions | 11.5.17 |
pimcore/pimcore Packagist | All versions | 11.5.17 |
pimcore/pimcore Packagist | From 12.0.0-RC1 | 12.3.6 |
pimcore/pimcore Packagist | From 12.0.0-RC1 | 12.3.6 |
pimcore/pimcore Packagist | From 2026.1.0 | 2026.1.2 |
pimcore/pimcore Packagist | From 2026.1.0 | 2026.1.2 |
How do I fix CVE-2026-44739?
Upgrade pimcore/pimcore to a fixed version for your release line: 11.5.17, 12.3.6 or 2026.1.2.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-44739 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44739 exists.
Sources
Also known as GHSA-3234-gxc3-pq6f.