PT-2026-43628 · Git+2 · Pimcore+1
CVE-2026-44739
·
Published
2026-05-27
·
Updated
2026-07-19
CVSS v3.1
8.7
High
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Pimcore versions prior to 11.5.17 (LTS)
Pimcore versions prior to 12.3.6
Description
The
columnConfigAction endpoint in the CustomReportsBundle is susceptible to SQL injection. An attacker with the reports config permission can provide a malicious SQL configuration that is processed through CustomReportController:columnConfigAction, SqlAdapter::getColumns, SqlAdapter::buildQueryString, and Db::fetchAssociative(). Although the application filters certain DDL and DML keywords such as UPDATE, DELETE, and DROP, it fails to block arbitrary SELECT queries, UNION statements, and dangerous database functions. Additionally, the application returns database error messages in JSON responses, enabling error-based SQL injection to exfiltrate or manipulate database data.Recommendations
Update Pimcore to version 11.5.17 (LTS).
Update Pimcore to version 12.3.6.
Restrict access to the
columnConfigAction endpoint to only trusted administrators to minimize the risk of exploitation.Exploit
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pimcore
Pimcore/Pimcore