CVE-2026-55084: DHIS2 SQL Injection Vulnerability

CVE-2026-55084 Overview

CVE-2026-55084 is a SQL injection vulnerability in the District Health Information Software 2 (DHIS2) platform. The flaw resides in the filter parameter of the /api/sqlViews/{viewId}/data.json endpoint. Authenticated users with access to a SqlView can inject arbitrary SQL through a PostgreSQL expression that reflects output inside application error messages. This enables error-based SQL injection to extract arbitrary database content.

DHIS2 is a widely deployed information system for data capture, management, validation, analytics, and visualization. The vulnerability is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated attackers with SqlView access can exfiltrate arbitrary database contents including credentials, patient data, and configuration secrets via error-based SQL injection.

Affected Products

DHIS2 versions 2.37, 2.38, and 2.39 (End-of-Support as of 2026-06-09)
DHIS2 2.40.x before 2.40.11.1 and 2.40.12; 2.41.x before 2.41.8.2; 2.42.x before 2.42.5.1
DHIS2 2.43.0 before 2.43.0.1 and 2.44 development branch before PR #24162

Discovery Timeline

2026-07-21 - CVE-2026-55084 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-55084

Vulnerability Analysis

The vulnerability exists in the DHIS2 SqlView API, which allows privileged users to query stored SQL views. The filter parameter passed to /api/sqlViews/{viewId}/data.json is not properly neutralized before being incorporated into a PostgreSQL expression. When the server evaluates the crafted expression and encounters an error, the resulting message reflects data from the injected subquery back to the caller.

An attacker constructs a filter value that contains a PostgreSQL expression such as a CAST or type conversion operation wrapping a subquery. When PostgreSQL attempts to convert the subquery result to an incompatible type, it emits an error containing the queried value. DHIS2 surfaces this error to the API response, giving the attacker a channel to read arbitrary rows from any table the application database user can access.

Root Cause

The root cause is insufficient input sanitization of user-supplied filter expressions before concatenation into a SQL statement executed by PostgreSQL. The application relies on the SqlView authorization model as a trust boundary but fails to treat authenticated input as untrusted at the SQL layer.

Attack Vector

Exploitation requires network access to the DHIS2 API and an authenticated account with permission to query at least one SqlView. The attacker issues a crafted GET request against /api/sqlViews/{viewId}/data.json with a malicious filter parameter. The response body contains the leaked value inside the PostgreSQL error text. Refer to the GitHub Security Advisory GHSA-pwmg-mvjw-4m23 and the upstream fix in PR #24162 for technical details.

Detection Methods for CVE-2026-55084

Indicators of Compromise

HTTP requests to /api/sqlViews/{viewId}/data.json with filter parameters containing SQL keywords such as SELECT, CAST, CHR, pg_sleep, or information_schema
Application logs showing repeated PostgreSQL type-conversion or syntax errors originating from SqlView requests
Unusually long or URL-encoded filter values submitted by non-administrative user accounts

Detection Strategies

Inspect DHIS2 access logs for anomalous query patterns against the SqlView API from a single authenticated user
Alert on PostgreSQL error messages that reference filter evaluation and contain reflected user data in HTTP responses
Correlate authentication events with API usage to identify low-privilege accounts probing SqlView endpoints

Monitoring Recommendations

Enable verbose audit logging on the DHIS2 API tier and forward events to a centralized analytics platform
Monitor PostgreSQL query logs for statements originating from the DHIS2 application user that contain injected subqueries against pg_catalog or information_schema
Track outbound data volume from the DHIS2 database host to detect bulk extraction attempts

How to Mitigate CVE-2026-55084

Immediate Actions Required

Upgrade to a patched DHIS2 release: 2.40.11.1, 2.40.12, 2.41.8.2, 2.42.5.1, or 2.43.0.1
Retire deployments running end-of-support versions 2.37, 2.38, and 2.39, which will not receive fixes
Audit user accounts and remove SqlView access from users who do not require it
Rotate database credentials and secrets that may have been exposed through prior queries

Patch Information

The fix is delivered in dhis2-core PR #24162, which enforces proper escaping and validation of the filter parameter before it reaches the PostgreSQL execution layer. Full remediation details are published in GHSA-pwmg-mvjw-4m23.

Workarounds

Restrict SqlView authority to a minimal set of trusted administrators until patching is complete
Deploy a web application firewall rule that blocks SQL metacharacters and PostgreSQL functions in the filter query parameter of /api/sqlViews/*/data.json
Configure the DHIS2 database role to use least privilege, denying access to tables outside the application schema

bash

# Example WAF rule (ModSecurity syntax) blocking suspicious filter values
SecRule REQUEST_URI "@rx /api/sqlViews/.*/data\.json" \
  "chain,phase:2,deny,status:403,id:1055084,msg:'DHIS2 SqlView filter injection attempt'"
  SecRule ARGS:filter "@rx (?i)(select|cast|chr|pg_sleep|information_schema|union)" "t:urlDecodeUni"