CVE-2026-44739: Pimcore Custom Reports SQLI Vulnerability

CVE-2026-44739 Overview

CVE-2026-44739 is a SQL injection vulnerability [CWE-89] in Pimcore, an open source data and experience management platform. The flaw resides in the columnConfigAction endpoint within bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php. Malicious SQL configuration flows through CustomReportController::columnConfigAction, SqlAdapter::getColumns, SqlAdapter::buildQueryString, and reaches Db::fetchAssociative() without sufficient validation. An authenticated attacker holding the reports_config permission can inject arbitrary SELECT queries, UNION statements, dangerous database functions, and error-based payloads. The vulnerability affects Pimcore versions prior to 11.5.17 (LTS) and 12.3.6.

Critical Impact
Authenticated attackers with the reports_config permission can exfiltrate or manipulate arbitrary database records through crafted Custom Report configurations.

Affected Products

Pimcore versions prior to 11.5.17 (LTS)
Pimcore versions prior to 12.3.6
Custom Reports Bundle (CustomReportsBundle)

Discovery Timeline

2026-07-17 - CVE-2026-44739 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-44739

Vulnerability Analysis

The vulnerability is a classic second-order SQL injection reachable through the Custom Reports administration workflow. When an operator saves a Custom Report configuration, the SQL body is stored and later reconstructed by SqlAdapter::buildQueryString. The pre-patch validation used a permissive regular expression to reject destructive statements, but it did not account for SQL comment syntax or newline variants. Attackers could smuggle ALTER, DROP, or UPDATE clauses past the filter and reach Db::fetchAssociative(), which executed the crafted query against the primary database connection. Because the endpoint accepts full SELECT bodies for legitimate report design, UNION-based extraction and error-based inference techniques both apply directly.

Root Cause

The root cause is insufficient sanitization of user-supplied SQL fragments combined with a weak denylist check. The original regex /(ALTER|CREATE|DROP|RENAME|TRUNCATE|UPDATE|DELETE) /i matched only when a literal space followed the keyword and ignored comments. Attackers bypassed it using inline comments such as DROP/**/TABLE or tab and newline separators.

Attack Vector

Exploitation requires an authenticated Pimcore user with the reports_config permission. The attacker submits a crafted Custom Report definition to columnConfigAction, embedding malicious SQL in the configuration payload. The server rebuilds and executes the query, returning column metadata and result rows that leak database contents.

php

         if ($configuration) {
             $sql = $this->buildQueryString($configuration);
         }
+        $sqlStripped = $this->stripSqlCommentsForValidation($sql);
 
-        if (!preg_match('/(ALTER|CREATE|DROP|RENAME|TRUNCATE|UPDATE|DELETE) /i', $sql, $matches)) {
+        if (
+            !preg_match('/(ALTER|CREATE|DROP|RENAME|TRUNCATE|UPDATE|DELETE)\s/i', $sqlStripped, $matches)
+        ) {
             $sql .= ' LIMIT 0,1';
             $db = Db::get();
             $res = $db->fetchAssociative($sql);

Source: GitHub Commit 3fd7733. The patch strips SQL comments before validation and replaces the literal space in the denylist with \s to match any whitespace character.

Detection Methods for CVE-2026-44739

Indicators of Compromise

HTTP POST requests to /admin/reports/custom-report/column-config or equivalent routes containing SQL keywords such as UNION, SLEEP, LOAD_FILE, or INFORMATION_SCHEMA in the configuration payload.
Custom Report definitions stored in Pimcore that reference tables outside the reporting scope, including mysql.user, pimcore_users, or assets.
Unexpected database errors in Pimcore application logs originating from SqlAdapter::buildQueryString or Db::fetchAssociative.

Detection Strategies

Inspect audit logs for accounts with the reports_config permission editing or previewing Custom Reports at unusual times or frequencies.
Enable MySQL general query logging temporarily and correlate queries containing comment sequences (/**/, -- ) with Pimcore admin sessions.
Deploy web application firewall rules that flag SQL metacharacters inside JSON fields submitted to the Custom Reports admin endpoints.

Monitoring Recommendations

Alert on any newly assigned reports_config permission and review the change against ticketed access requests.
Baseline the volume of Custom Report preview requests per user and alert on deviations exceeding two standard deviations.
Forward Pimcore admin access logs to a centralized SIEM and retain them for a minimum of 90 days for retrospective hunting.

How to Mitigate CVE-2026-44739

Immediate Actions Required

Upgrade Pimcore to version 11.5.17 (LTS) or 12.3.6 as soon as possible.
Audit all accounts holding the reports_config permission and revoke access from users who do not require it.
Review stored Custom Report configurations for suspicious SQL fragments introduced before the patch was applied.

Patch Information

The fix is delivered in Pimcore 11.5.17 (LTS) and 12.3.6. The commit 3fd7733464f464e58ffa49ed91550c1a3f9535f2 introduces stripSqlCommentsForValidation and hardens the keyword denylist. Additional context is available in the GitHub Security Advisory GHSA-3234-gxc3-pq6f and the v12.3.6 release notes.

Workarounds

Restrict the reports_config permission to a small, trusted operator group until the upgrade is completed.
Place the Pimcore admin interface behind a VPN or IP allow list to limit exposure of the vulnerable endpoint.
Configure the underlying database account used by Pimcore with least-privilege grants that exclude access to unrelated schemas.

bash

# Verify installed Pimcore version and upgrade via Composer
composer show pimcore/pimcore | grep versions
composer require pimcore/pimcore:^12.3.6 --with-all-dependencies
bin/console cache:clear --env=prod