CVE-2026-55416: SQL Injection Vulnerability in Pimcore Custom Reports
Summary
CVE-2026-55416: Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration. Affects pimcore/pimcore across 3 version ranges.
< 11.5.19
>= 12.0.0-RC1, < 12.3.10
>= 2026.1.0, < 2026.1.6
Fixed in 11.5.19, 12.3.10 or 2026.1.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pimcore is an open-source digital experience platform that enables users to manage content, products, and assets in a unified manner. It provides a robust framework for building complex web applications and offers features like content management, e-commerce, and data management. The Custom Reports bundle allows users to create tailored reports from the data managed within Pimcore. However, a critical SQL injection vulnerability has been identified in this bundle, which could lead to severe data breaches if exploited.
Vulnerability Detail
The vulnerability arises from improper handling of user input in the Custom Reports bundle, specifically within the SQL query construction process. An authenticated attacker with 'reports_config' permission can inject arbitrary SQL commands through the report configuration fields, such as 'sql', 'from', 'where', and 'groupby'. These fields are concatenated directly into SQL queries without proper parameterization, allowing attackers to bypass basic regex blacklisting. This can lead to unauthorized data access, modification, or deletion, resulting in complete database compromise. Additionally, the LIMIT clause is vulnerable due to direct interpolation of user-controlled values without casting, creating further injection points.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 11.5.1911.5.19composer require pimcore/pimcore:11.5.19 -
>= 12.0.0-RC1, < 12.3.1012.3.10composer require pimcore/pimcore:12.3.10 -
>= 2026.1.0, < 2026.1.62026.1.6composer require pimcore/pimcore:2026.1.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
- Restrict 'reports_config' permission to only highly trusted administrators.
- Deploy a Web Application Firewall (WAF) rule to block requests to '/admin/bundle/customreports/custom-report/update' containing SQL keywords in the 'configuration' parameter.
- Replace the custom SQL adapter with a parameterized query builder approach.
Conclusion
The SQL injection vulnerability in the Pimcore Custom Reports bundle poses a significant risk to data integrity and security. It is crucial for users to update to the latest patched versions and implement recommended workarounds to mitigate potential threats. Regular monitoring and vulnerability assessments are essential to maintain the security of applications.
See every vulnerability recorded for pimcore/pimcore →
FAQ
CVE-2026-55416 is a SQL injection vulnerability found in the Pimcore Custom Reports bundle that allows authenticated users to execute arbitrary SQL commands.
Any Pimcore installation that has the Custom Reports bundle enabled and allows users with 'reports_config' permission is potentially affected.
Exploitation of this vulnerability can lead to unauthorized access, modification, or deletion of sensitive data in the database, resulting in complete data compromise.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without requiring any signup.
The CVSS score for CVE-2026-55416 is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pimcore/pimcore.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.