CVE-2026-55416: Pimcore SQL injection in Custom Reports via configuration

CVE-2026-55416 · Severity: high · CVSS 8.8 · Published 2026-09-14

Pimcore's Custom Reports feature allows administrators to define custom SQL queries for data analysis. An authenticated admin user with report configuration permissions can inject arbitrary SQL commands through report configuration fields (sql, from, where, groupby), bypassing weak keyword-based filtering. This enables attackers to read, modify, or delete all data in the underlying database, resulting in complete compromise of all business data stored in the application.

Technologies: pimcore/pimcore (Packagist), Pimcore. Vendors: Packagist, Pimcore.

Quick answers

Is CVE-2026-55416 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55416 being exploited in the wild.
How severe is CVE-2026-55416?
High severity, with a CVSS score of 8.8, published 14 September 2026.
Which products and versions are affected?
pimcore/pimcore (Packagist) ECOSYSTEM:introduced=2026.1.0,fixed=2026.1.6; Pimcore >= 2026.1.0, <= 2026.1.5; >= 12.0.0-RC1, <= 12.3.9; < 11.5.18.
Is there a fix for CVE-2026-55416?
Yes. pimcore/pimcore (Packagist): upgrade to 2026.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55416 attacked?
It is attacked over the network.
Am I affected by CVE-2026-55416?
Check whether you run pimcore/pimcore (Packagist) or Pimcore at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • pimcore/pimcore (Packagist): upgrade to 2026.1.6 or later
    composer require pimcore/pimcore:^2026.1.6

Technical details

The vulnerability exists in the Sql adapter's buildQueryString() and getData() methods, where user-controlled configuration fields (sql, from, where, groupby) are directly concatenated into SQL queries without parameterization. The only protection is a regex blacklist checking for ALTER|CREATE|DROP|RENAME|TRUNCATE|UPDATE|DELETE keywords, which is trivially bypassable using INSERT, UNION SELECT, LOAD_FILE(), INTO OUTFILE, stacked queries, subqueries, or MySQL comment injection (/*!*/). Additionally, the LIMIT clause at line 51 directly interpolates $offset and $limit without integer casting, creating a secondary injection point. Exploitation requires authentication with reports_config permission and a valid admin session. An attacker can use UNION-based injection to extract arbitrary database tables (e.g., INFORMATION_SCHEMA) or execute INSERT/UPDATE/DELETE via unblocked SQL constructs. Patches are available in versions 2026.1.6, 12.3.10, and 11.5.19.

Affected products

  • Pimcore pimcore >= 2026.1.0, <= 2026.1.5; >= 12.0.0-RC1, <= 12.3.9; < 11.5.18

Identifiers

  • CVE-2026-55416
  • GHSA-23rh-xw42-fq82

Timeline

  • 2026-09-10: disclosed
  • 2026-09-10: patched: Patched versions 2026.1.6, 12.3.10, 11.5.19 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.