CVE-2026-44739: Pimcore SQL injection in CustomReportsBundle columnConfigAction

CVE-2026-44739 · Severity: high · CVSS 8.7 · Published 2026-07-17

Pimcore, an open-source platform for managing enterprise data and customer experiences, contains a security flaw in its custom reporting module. An authorized user with reporting permissions can execute malicious database commands to bypass security filters and access or modify sensitive information. This could lead to the unauthorized exposure of corporate data or the manipulation of critical database records.

Technologies: pimcore/pimcore (Packagist), Pimcore. Vendors: Packagist, Pimcore.

Quick answers

Is CVE-2026-44739 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44739 being exploited in the wild.
How severe is CVE-2026-44739?
High severity, with a CVSS score of 8.7, published 17 July 2026.
Which products and versions are affected?
pimcore/pimcore (Packagist) <= 12.3.5, ECOSYSTEM:introduced=2026.1.0,fixed=2026.1.2; Pimcore < 11.5.17, >= 12.0.0 < 12.3.6, <= 12.3.5.
Is there a fix for CVE-2026-44739?
Yes. pimcore/pimcore (Packagist): upgrade to 2026.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44739 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-44739?
Check whether you run pimcore/pimcore (Packagist) or Pimcore at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • pimcore/pimcore (Packagist): upgrade to 2026.1.2 or later
    composer require pimcore/pimcore:^2026.1.2

Technical details

A SQL injection vulnerability exists in the `columnConfigAction` endpoint within `bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php`. The application fails to properly sanitize SQL configurations passed through `SqlAdapter::getColumns` and `SqlAdapter::buildQueryString` before execution via `Db::fetchAssociative()`. While the application attempts to filter DDL/DML keywords like UPDATE or DELETE, the regex is insufficient and can be bypassed using comments or specific formatting. An attacker with `reports_config` permissions can perform arbitrary SELECT queries, UNION-based attacks, and error-based SQL injection to exfiltrate data or modify the database. The issue is resolved in versions 11.5.17 (LTS) and 12.3.6.

Affected products

  • Pimcore Pimcore < 11.5.17, >= 12.0.0 < 12.3.6

Identifiers

  • CVE-2026-44739
  • GHSA-3234-gxc3-pq6f

Timeline

  • 2026-04-29: patched: Fix merged into version 12.3 branch
  • 2026-05-26: advisory: GitHub Security Advisory published
  • 2026-07-17: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.