CVE-2026-55416: Pimcore Custom Reports SQL Injection Flaw

CVE-2026-55416 Overview

Pimcore is an open source data and experience management platform used to manage digital assets, product information, and customer experiences. CVE-2026-55416 is a SQL injection vulnerability [CWE-89] in the Custom Reports feature affecting versions prior to 11.5.19, 12.3.10, and 2026.1.6. An authenticated user with the reports_config permission can inject arbitrary SQL fragments through configuration fields processed by the Sql.php adapter. Successful exploitation allows disclosure, modification, or deletion of arbitrary database records.

Critical Impact
Authenticated attackers with report configuration access can execute arbitrary SQL statements, resulting in full read/write access to the underlying Pimcore database.

Affected Products

Pimcore versions prior to 11.5.19
Pimcore versions prior to 12.3.10
Pimcore versions prior to 2026.1.6

Discovery Timeline

2026-09-14 - CVE-2026-55416 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-55416

Vulnerability Analysis

The vulnerability resides in the Custom Reports bundle at bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php. The buildQueryString() method concatenates user-supplied values from the sql, from, where, and groupby configuration fields directly into a database query. The implementation relies on a blacklist that filters constructs such as data-manipulation statements, comments, subqueries, and stacked queries. Blacklist-based filtering is inherently incomplete and can be bypassed with alternative SQL syntax.

Additionally, the getData() method interpolated offset and limit values into the LIMIT clause without integer casting. This allowed attackers to inject SQL through numeric parameters that were assumed to be safe. When the configured report executes, fetchAllAssociative() runs the constructed query against the database.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. String concatenation is used to build queries from user-controlled input, and the blacklist filter fails to enumerate every dangerous SQL construct. Numeric parameters lacked type casting, extending the attack surface beyond the string fields.

Attack Vector

Exploitation requires an authenticated Pimcore account holding the reports_config permission. The attacker creates or edits a Custom Report configuration and embeds SQL payloads in the vulnerable fields. When the report runs, the injected SQL executes with the privileges of the Pimcore database user. Because the platform typically operates with broad schema access, attackers can read sensitive tables, alter records, or drop data.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-23rh-xw42-fq82 and the remediation commit for technical details.

Detection Methods for CVE-2026-55416

Indicators of Compromise

Unexpected modifications to Custom Report configurations, particularly changes to the sql, from, where, or groupby fields containing SQL keywords such as UNION, INTO OUTFILE, or encoded comment sequences.
Database query logs showing anomalous statements originating from the Pimcore application user outside normal reporting patterns.
Elevated read volume against sensitive tables such as users, application_logs, or asset metadata triggered by report executions.

Detection Strategies

Audit the Pimcore administrative activity log for creation or modification of Custom Reports by accounts that do not routinely author reports.
Enable MySQL or MariaDB general query logging on non-production tiers and inspect statements issued by the Pimcore service account for injection patterns.
Correlate authentication events for accounts holding reports_config with subsequent report execution events to identify unusual sequences.

Monitoring Recommendations

Alert on any Custom Report configuration change performed outside approved change-management windows.
Monitor database error rates and slow-query counts, as blind SQL injection frequently triggers syntax errors or long-running queries.
Track privilege assignments granting the reports_config permission and review the population regularly.

How to Mitigate CVE-2026-55416

Immediate Actions Required

Upgrade Pimcore to 11.5.19, 12.3.10, or 2026.1.6 as appropriate for your release branch.
Restrict the reports_config permission to a minimal set of trusted administrators until the patch is applied.
Review all existing Custom Report definitions for suspicious SQL fragments introduced prior to remediation.

Patch Information

The vulnerability is fixed in Pimcore v12.3.10, v2026.1.6, and 11.5.19. The fix is delivered in Pull Request #19175 and applied through commit 1999fee27ed0, which strengthens input handling in the Custom Reports SQL adapter and casts numeric pagination values to integers.

Workarounds

Revoke the reports_config permission from all non-essential roles until upgrade is complete.
Place a web application firewall rule in front of the Pimcore admin interface to block SQL keywords in report configuration endpoints.
Configure the Pimcore database account with least-privilege access, removing rights such as DROP, ALTER, and FILE where not required.

bash

# Example: revoke destructive privileges from the Pimcore database user
REVOKE DROP, ALTER, CREATE, FILE ON pimcore.* FROM 'pimcore_app'@'%';
FLUSH PRIVILEGES;