fkie_cve-2026-55416

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reports_config permission can place attacker-controlled SQL fragments in the sql, from, where, and groupby fields of a Custom Reports configuration processed by bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php. The buildQueryString() method concatenates these values into a database query, while a blacklist omits dangerous constructs such as additional data-manipulation statements, comments, subqueries, and multiple statements. The getData() method also previously interpolated offset and limit values into a LIMIT clause without integer casting. Executing the configured report reaches fetchAllAssociative() with the constructed query and can disclose, modify, or delete arbitrary database data. This issue is fixed in versions 11.5.19, 12.3.10, and 2026.1.6.

GHSA-23rh-xw42-fq82 — Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration

Affected: Packagist: pimcore/pimcore

# Security Advisory: SQL Injection in Custom Reports via Malicious Report Configuration

## Summary

### Impact

A SQL injection vulnerability exists in the Custom Reports bundle (`bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php:84-135`). An authenticated attacker with `reports_config` permission can inject arbitrary SQL via the report configuration fields (`sql`, `from`, `where`, `groupby`), which are directly concatenated into SQL queries without parameterization. The only protection is a regex blacklist that checks for `ALTER|CREATE|DROP|RENAME|TRUNCATE|UPDATE|DELETE` keywords, which is trivially bypassable — it does not block `INSERT`, `UNION SELECT`, `LOAD_FILE()`, `INTO OUTFILE`, stacked queries, subqueries, or MySQL comment injection (`/*!*/`). Exploitation allows reading, modifying, or deleting all data in the database, leading to complete data compromise.

Additionally, the LIMIT clause at line 51 directly interpolates `$offset` and `$limit` without integer casting, creating a secondary injection point.

### Patches

Versions 2026.1.6, 12.3.10, 11.5.19.

### Workarounds

1. Restrict `reports_config` permission to only highly trusted administrators 2. Deploy a WAF rule to block requests to `/admin/bundle/customreports/custom-report/update` containing SQL keywords in the `configuration` parameter 3. Replace the custom SQL adapter with a parameterized query builder approach

## Attack Path (Validation Evidence)

``` [Entry Point] POST /admin/bundle/customreports/c…

Most recent entries from all

fkie_cve-2026-55416

GHSA-23rh-xw42-fq82 — Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration