Is CVE-2026-55084 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55084 being exploited in the wild.

How severe is CVE-2026-55084?

High severity, with a CVSS score of 8.8, published 21 July 2026.

Which products and versions are affected?

DHIS2 Core 2.37, 2.38, 2.39, 2.40.x before 2.40.11.1/2.40.12, 2.41.x before 2.41.8.2, 2.42.x before 2.42.5.1, 2.43.0 before 2.43.0.1, 2.44 development branch before PR #24162.

Is there a fix for CVE-2026-55084?

A patch was published on 2026-06-09: Security backports merged into master and stable branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55084 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-55084?

Check whether you run DHIS2 Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55084: DHIS2 SQL injection in SqlView API filter parameter

CVE-2026-55084 · Severity: high · CVSS 8.8 · Published 2026-07-21

DHIS2 is an open-source information system used globally for managing health data and analytics. A security flaw in its reporting interface allows logged-in users to run unauthorized database commands. This could allow an attacker to steal sensitive health records or administrative data, potentially compromising the privacy of individuals and the integrity of the health system.

Technologies: DHIS2 Core. Vendors: DHIS2.

Quick answers

Is CVE-2026-55084 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55084 being exploited in the wild.
How severe is CVE-2026-55084?: High severity, with a CVSS score of 8.8, published 21 July 2026.
Which products and versions are affected?: DHIS2 Core 2.37, 2.38, 2.39, 2.40.x before 2.40.11.1/2.40.12, 2.41.x before 2.41.8.2, 2.42.x before 2.42.5.1, 2.43.0 before 2.43.0.1, 2.44 development branch before PR #24162.
Is there a fix for CVE-2026-55084?: A patch was published on 2026-06-09: Security backports merged into master and stable branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55084 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55084?: Check whether you run DHIS2 Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in the `DefaultSqlViewService.getFilterQuery` component of DHIS2. The root cause is the failure to quote or sanitize the column-name slot within the `filter` parameter of the `/api/sqlViews/{viewId}/data.json` endpoint. An authenticated attacker with read access to a SQL View can provide a malicious string that is concatenated directly into a PostgreSQL WHERE clause. This can be exploited via UNION-based injection or error-based injection (using CAST subqueries) to exfiltrate arbitrary data from the database. The vulnerability was addressed by implementing proper identifier quoting using `SqlUtils.quote()`.

Affected products

DHIS2 dhis2-core 2.37, 2.38, 2.39, 2.40.x before 2.40.11.1/2.40.12, 2.41.x before 2.41.8.2, 2.42.x before 2.42.5.1, 2.43.0 before 2.43.0.1, 2.44 development branch before PR #24162

Timeline

2026-06-09: patched: Security backports merged into master and stable branches
2026-07-21: disclosed: CVE-2026-55084 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.