PT-2026-43628 · Git+2 · Pimcore+1

CVE-2026-44739

·

Published

2026-05-27

·

Updated

2026-07-19

CVSS v3.1

8.7

High

VectorAV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 11.5.17 (LTS) Pimcore versions prior to 12.3.6
Description The columnConfigAction endpoint in the CustomReportsBundle is susceptible to SQL injection. An attacker with the reports config permission can provide a malicious SQL configuration that is processed through CustomReportController:columnConfigAction, SqlAdapter::getColumns, SqlAdapter::buildQueryString, and Db::fetchAssociative(). Although the application filters certain DDL and DML keywords such as UPDATE, DELETE, and DROP, it fails to block arbitrary SELECT queries, UNION statements, and dangerous database functions. Additionally, the application returns database error messages in JSON responses, enabling error-based SQL injection to exfiltrate or manipulate database data.
Recommendations Update Pimcore to version 11.5.17 (LTS). Update Pimcore to version 12.3.6. Restrict access to the columnConfigAction endpoint to only trusted administrators to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2026-44739
GHSA-3234-GXC3-PQ6F

Affected Products

Pimcore
Pimcore/Pimcore