CVE-2026-55416 Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration
Authenticated users with report permissions can inject SQL via custom report configurations, allowing arbitrary database data disclosure, modification, or deletion.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55416?
CVE-2026-55416 is a high-severity SQL injection vulnerability in pimcore, published on 14 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reports_config permission can place attacker-controlled SQL fragments in the sql, from, where, and groupby fields of a Custom Reports configuration processed by bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php. The buildQueryString() method concatenates these values into a database query, while a blacklist omits dangerous constructs such as additional data-manipulation statements, comments, subqueries, and multiple statements. The getData() method also previously interpolated offset and limit values into a LIMIT clause without integer casting. Executing the configured report reaches fetchAllAssociative() with the constructed query and can disclose, modify, or delete arbitrary database data. This issue is fixed in versions 11.5.19, 12.3.10, and 2026.1.6.
Weakness: CWE-89
Which versions are affected by CVE-2026-55416?
6 open source packages ship an affected version, including pimcore/pimcore.
| Package | Affected | Fixed in |
|---|---|---|
pimcore/pimcore Packagist | All versions | 11.5.19 |
pimcore/pimcore Packagist | All versions | 11.5.19 |
pimcore/pimcore Packagist | From 12.0.0-RC1 | 12.3.10 |
pimcore/pimcore Packagist | From 12.0.0-RC1 | 12.3.10 |
pimcore/pimcore Packagist | From 2026.1.0 | 2026.1.6 |
pimcore/pimcore Packagist | From 2026.1.0 | 2026.1.6 |
How do I fix CVE-2026-55416?
Upgrade pimcore/pimcore to a fixed version for your release line: 11.5.19, 12.3.10 or 2026.1.6.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-55416 being exploited?
There is no known exploitation of CVE-2026-55416 in the wild and no public exploit code.
Sources
Also known as GHSA-23rh-xw42-fq82.