# CVE-2026-44739: Pimcore SQL injection in CustomReportsBundle columnConfigAction

Source: https://junglewise.ai/threats/cve-2026-44739-pimcore-sql-injection-in-customreportsbundle-columnconfigaction  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-44739 · Severity: high · CVSS 8.7 · Published 2026-07-17

Pimcore, an open-source platform for managing enterprise data and customer experiences, contains a security flaw in its custom reporting module. An authorized user with reporting permissions can execute malicious database commands to bypass security filters and access or modify sensitive information. This could lead to the unauthorized exposure of corporate data or the manipulation of critical database records.

Technologies: [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore), [Pimcore](https://junglewise.ai/threats/technologies/pimcore). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Pimcore](https://junglewise.ai/threats/vendors/pimcore).

## Quick answers

**Is CVE-2026-44739 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44739 being exploited in the wild.

**How severe is CVE-2026-44739?** High severity, with a CVSS score of 8.7, published 17 July 2026.

**Which products and versions are affected?** pimcore/pimcore (Packagist) <= 12.3.5, ECOSYSTEM:introduced=2026.1.0,fixed=2026.1.2; Pimcore < 11.5.17, >= 12.0.0 < 12.3.6, <= 12.3.5.

**Is there a fix for CVE-2026-44739?** Yes. pimcore/pimcore (Packagist): upgrade to 2026.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44739 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-44739?** Check whether you run pimcore/pimcore (Packagist) or Pimcore at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pimcore/pimcore (Packagist): upgrade to 2026.1.2 or later

  ```sh
  composer require pimcore/pimcore:^2026.1.2
  ```


## Technical details

A SQL injection vulnerability exists in the `columnConfigAction` endpoint within `bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php`. The application fails to properly sanitize SQL configurations passed through `SqlAdapter::getColumns` and `SqlAdapter::buildQueryString` before execution via `Db::fetchAssociative()`. While the application attempts to filter DDL/DML keywords like UPDATE or DELETE, the regex is insufficient and can be bypassed using comments or specific formatting. An attacker with `reports_config` permissions can perform arbitrary SELECT queries, UNION-based attacks, and error-based SQL injection to exfiltrate data or modify the database. The issue is resolved in versions 11.5.17 (LTS) and 12.3.6.

## Affected products

- Pimcore Pimcore < 11.5.17, >= 12.0.0 < 12.3.6

## Identifiers

- CVE-2026-44739
- GHSA-3234-gxc3-pq6f

## Timeline

- 2026-04-29: patched: Fix merged into version 12.3 branch
- 2026-05-26: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: CVE published to NVD

## References

- [https://github.com/pimcore/pimcore/commit/3fd7733464f464e58ffa49ed91550c1a3f9535f2](https://github.com/pimcore/pimcore/commit/3fd7733464f464e58ffa49ed91550c1a3f9535f2)
- [https://github.com/pimcore/pimcore/pull/19098](https://github.com/pimcore/pimcore/pull/19098)
- [https://github.com/pimcore/pimcore/releases/tag/v12.3.6](https://github.com/pimcore/pimcore/releases/tag/v12.3.6)
- [https://github.com/pimcore/pimcore/security/advisories/GHSA-3234-gxc3-pq6f](https://github.com/pimcore/pimcore/security/advisories/GHSA-3234-gxc3-pq6f)

## Related threats

- [Pimcore stored cross-site scripting in data objects](https://junglewise.ai/threats/cve-2026-109392-pimcore-through-2026-3-1-contains-a-stored-cross-site-scripting)
- [Pimcore SQL injection in Custom Reports via configuration](https://junglewise.ai/threats/cve-2026-55416-pimcore-sql-injection-in-custom-reports-via-configuration)
- [Pimcore ClassDefinition UID regex SQL injection in Block.php](https://junglewise.ai/threats/cve-2026-55072-pimcore-classdefinition-uid-regex-sql-injection-in-block-php)
- [Pimcore DataObject class-definition field name remote code execution](https://junglewise.ai/threats/cve-2026-55634-pimcore-dataobject-class-definition-field-name-remote-code)
- [Pimcore Hotspotimage unrestricted PHP object deserialization](https://junglewise.ai/threats/cve-2026-55220-pimcore-hotspotimage-unrestricted-php-object-deserialization)