# CVE-2026-55084: DHIS2 SQL injection in SqlView API filter parameter

Source: https://junglewise.ai/threats/cve-2026-55084-dhis2-sql-injection-in-sqlview-api-filter-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-55084 · Severity: high · CVSS 8.8 · Published 2026-07-21

DHIS2 is an open-source information system used globally for managing health data and analytics. A security flaw in its reporting interface allows logged-in users to run unauthorized database commands. This could allow an attacker to steal sensitive health records or administrative data, potentially compromising the privacy of individuals and the integrity of the health system.

Technologies: [DHIS2 Core](https://junglewise.ai/threats/technologies/dhis2-core). Vendors: [DHIS2](https://junglewise.ai/threats/vendors/dhis2).

## Quick answers

**Is CVE-2026-55084 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55084 being exploited in the wild.

**How severe is CVE-2026-55084?** High severity, with a CVSS score of 8.8, published 21 July 2026.

**Which products and versions are affected?** DHIS2 Core 2.37, 2.38, 2.39, 2.40.x before 2.40.11.1/2.40.12, 2.41.x before 2.41.8.2, 2.42.x before 2.42.5.1, 2.43.0 before 2.43.0.1, 2.44 development branch before PR #24162.

**Is there a fix for CVE-2026-55084?** A patch was published on 2026-06-09: Security backports merged into master and stable branches Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55084 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-55084?** Check whether you run DHIS2 Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the `DefaultSqlViewService.getFilterQuery` component of DHIS2. The root cause is the failure to quote or sanitize the column-name slot within the `filter` parameter of the `/api/sqlViews/{viewId}/data.json` endpoint. An authenticated attacker with read access to a SQL View can provide a malicious string that is concatenated directly into a PostgreSQL WHERE clause. This can be exploited via UNION-based injection or error-based injection (using CAST subqueries) to exfiltrate arbitrary data from the database. The vulnerability was addressed by implementing proper identifier quoting using `SqlUtils.quote()`.

## Affected products

- DHIS2 dhis2-core 2.37, 2.38, 2.39, 2.40.x before 2.40.11.1/2.40.12, 2.41.x before 2.41.8.2, 2.42.x before 2.42.5.1, 2.43.0 before 2.43.0.1, 2.44 development branch before PR #24162

## Timeline

- 2026-06-09: patched: Security backports merged into master and stable branches
- 2026-07-21: disclosed: CVE-2026-55084 published

## References

- [https://github.com/dhis2/dhis2-core/pull/24162](https://github.com/dhis2/dhis2-core/pull/24162)
- [https://github.com/dhis2/dhis2-core/security/advisories/GHSA-pwmg-mvjw-4m23](https://github.com/dhis2/dhis2-core/security/advisories/GHSA-pwmg-mvjw-4m23)

## Related threats

- [DHIS2 SQL injection in SQL View data endpoints](https://junglewise.ai/threats/cve-2026-55082-dhis2-sql-injection-in-sql-view-data-endpoints)
- [DHIS2 dhis2-core reflected XSS in OpenAPI HTML endpoint](https://junglewise.ai/threats/cve-2026-55081-dhis2-dhis2-core-reflected-xss-in-openapi-html-endpoint)