Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration

Published September 10, 2026 CVE-2026-55416

Pimcore's custom reports can let an authorized attacker read, change, or delete database data. The attacker needs an account with permission to configure reports.

Severity
HighCVSS 8.8
Fix
Fixed in 2026.1.6, 12.3.10, 11.5.19Fix recorded today
Affected versions
2026.1.0 or newer and 2026.1.5 or older; 12.0.0-RC1 or newer and 12.3.9 or older; before 11.5.18
Affects
pimcore

How it works

  • An attacker with report-configuration permission can place SQL commands in custom report settings.
  • Pimcore inserts those settings directly into database queries instead of safely separating commands from data.
  • Its keyword blocklist misses several SQL techniques, allowing database commands to run.
  • The advisory says this can expose, modify, or delete database data.

What to do

Compare the installed Pimcore version with the advisory's affected ranges: 2026.1.0 through 2026.1.5, 12.0.0-RC1 through 12.3.9, or below 11.5.18. Also confirm which accounts can configure custom reports.

Update to Pimcore 2026.1.6, 12.3.10, or 11.5.19, matching your release branch. Until then, restrict report-configuration permission to highly trusted administrators and follow the advisory's mitigation guidance.

Technical details

CVE-2026-55416 affects Pimcore's Custom Reports bundle. Authenticated users with reports_config permission control fields that are concatenated into SQL queries without parameterization, allowing arbitrary database read, modification, or deletion.

References

View Original Source