Executive brief
DHIS2 is an open-source information system used globally for managing health data and analytics. A security flaw in its reporting interface allows logged-in users to run unauthorized database commands. This could allow an attacker to steal sensitive health records or administrative data, potentially compromising the privacy of individuals and the integrity of the health system.
Technical details
A SQL injection vulnerability exists in the `DefaultSqlViewService.getFilterQuery` component of DHIS2. The root cause is the failure to quote or sanitize the column-name slot within the `filter` parameter of the `/api/sqlViews/{viewId}/data.json` endpoint. An authenticated attacker with read access to a SQL View can provide a malicious string that is concatenated directly into a PostgreSQL WHERE clause. This can be exploited via UNION-based injection or error-based injection (using CAST subqueries) to exfiltrate arbitrary data from the database. The vulnerability was addressed by implementing proper identifier quoting using `SqlUtils.quote()`.
Affected products
- DHIS2 dhis2-core 2.37, 2.38, 2.39, 2.40.x before 2.40.11.1/2.40.12, 2.41.x before 2.41.8.2, 2.42.x before 2.42.5.1, 2.43.0 before 2.43.0.1, 2.44 development branch before PR #24162
Timeline
- 2026-06-09: patched: Security backports merged into master and stable branches
- 2026-07-21: disclosed: CVE-2026-55084 published