Executive brief
Pimcore, an open-source platform for managing enterprise data and customer experiences, contains a security flaw in its custom reporting module. An authorized user with reporting permissions can execute malicious database commands to bypass security filters and access or modify sensitive information. This could lead to the unauthorized exposure of corporate data or the manipulation of critical database records.
Technical details
A SQL injection vulnerability exists in the `columnConfigAction` endpoint within `bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php`. The application fails to properly sanitize SQL configurations passed through `SqlAdapter::getColumns` and `SqlAdapter::buildQueryString` before execution via `Db::fetchAssociative()`. While the application attempts to filter DDL/DML keywords like UPDATE or DELETE, the regex is insufficient and can be bypassed using comments or specific formatting. An attacker with `reports_config` permissions can perform arbitrary SELECT queries, UNION-based attacks, and error-based SQL injection to exfiltrate data or modify the database. The issue is resolved in versions 11.5.17 (LTS) and 12.3.6.
Affected products
- Pimcore Pimcore < 11.5.17, >= 12.0.0 < 12.3.6
Timeline
- 2026-04-29: patched: Fix merged into version 12.3 branch
- 2026-05-26: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: CVE published to NVD