Pimcore Custom Reports SQL Injection Vulnerability (CVE-2026-55416)

What Happened

A SQL injection vulnerability was identified in Pimcore's Custom Reports functionality. An authenticated user holding the reports_config permission can place attacker-controlled SQL fragments into the sql, from, where, and groupby fields of a Custom Reports configuration. These fields are processed by the Sql.php adapter in the CustomReportsBundle.

Technical Cause

The buildQueryString() method in bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php concatenates user-supplied configuration values directly into a database query. The method relies on a blacklist to filter dangerous input, but this blacklist omits several dangerous constructs, including additional data-manipulation statements, SQL comments, subqueries, and multiple statements. Additionally, the getData() method previously interpolated offset and limit values into a LIMIT clause without casting them to integers, creating an additional injection path. When the configured report is executed, the constructed query reaches fetchAllAssociative(), allowing arbitrary database data to be disclosed, modified, or deleted.

Why It Matters

SQL injection vulnerabilities of this type can lead to full compromise of the confidentiality, integrity, and availability of the underlying database. The CVSS score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that the flaw is exploitable over the network with low attack complexity and requires no user interaction, though it does require low-privileged authentication. Since the attacker only needs the reports_config permission rather than full administrative access, this lowers the bar compared to vulnerabilities requiring higher privilege levels.

Who Is Affected

Organizations running pimcore/pimcore with the Custom Reports bundle enabled, where users have been granted the reports_config permission, are affected. The risk is primarily tied to accounts with this specific permission rather than all authenticated users.

Affected Versions

The vulnerability affects pimcore/pimcore versions prior to 11.5.18 (introduced at version 0), versions from 12.0.0 up to and including 12.3.9, and versions from 2026.1.0 up to and including 2026.1.5.

Fixes and Mitigation

Pimcore has released fixes in versions 11.5.19, 12.3.10, and 2026.1.6. These updates address the SQL injection issue in the Custom Reports configuration handling.

Recommended Action

Site owners and developers running affected versions of pimcore/pimcore should upgrade to version 11.5.19, 12.3.10, or 2026.1.6, depending on their current release branch. Until the update can be applied, administrators should review which users hold the reports_config permission and restrict it to trusted accounts only.