CVE-2026-55416

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55416
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55416.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55416
Aliases
Published
2026-09-14T16:52:28Z
Modified
2026-09-18T03:30:32Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization
Details

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reports_config permission can place attacker-controlled SQL fragments in the sql, from, where, and groupby fields of a Custom Reports configuration processed by bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php. The buildQueryString() method concatenates these values into a database query, while a blacklist omits dangerous constructs such as additional data-manipulation statements, comments, subqueries, and multiple statements. The getData() method also previously interpolated offset and limit values into a LIMIT clause without integer casting. Executing the configured report reaches fetchAllAssociative() with the constructed query and can disclose, modify, or delete arbitrary database data. This issue is fixed in versions 11.5.19, 12.3.10, and 2026.1.6.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-89"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55416.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "fixed":  "11.5.19"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/pimcore/pimcore

Affected ranges

Type
GIT
Repo
https://github.com/pimcore/pimcore
Events
Introduced
df14e025d3db615fc75b190e3c9f3cc1d68d7304
Introduced
37c14edb2693c4632187e2e78b6915c62af43042
Fixed
71b2af87d1a50027d7a59cb9f41da1ef807d892f
Fixed
ad60bad41946c33bebb4fd42e03b0a575759de02
Fixed
1999fee27ed0d027ad5b8195ecf6e27243729530
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "12.0.0"
        },
        {
            "fixed":  "12.3.10"
        },
        {
            "introduced":  "2026.1.0"
        },
        {
            "fixed":  "2026.1.6"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v12.*
v12.0.0
v12.1.0
v12.2.0
v12.2.1
v12.3.0
v12.3.1
v12.3.1.1
v12.3.2
v12.3.3
v12.3.4
v12.3.5
v12.3.7
v12.3.8
v12.3.9
v2026.*
v2026.1.0
v2026.1.1
v2026.1.2
v2026.1.3
v2026.1.4
v2026.1.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55416.json"