Vulnerability · Published Sep 14, 2026 · Assigned by GitHub_M

CVE-2026-55416Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization

High 8.8

In plain English

A high-severity SQL injection in pimcore from pimcore. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.7%top 48.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reports_config permission can place attacker-controlled SQL fragments in the sql, from, where, and groupby fields of a Custom Reports configuration processed by bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php. The buildQueryString() method concatenates these values into a database query, while a blacklist omits dangerous constructs such as additional data-manipulation statements, comments, subqueries, and multiple statements. The getData() method also previously interpolated offset and limit values into a LIMIT clause without integer casting. Executing the configured report reaches fetchAllAssociative() with the constructed query and can disclose, modify, or delete arbitrary database data. This issue is fixed in versions 11.5.19, 12.3.10, and 2026.1.6.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	pimcore/pimcore	2026.1.6	GHSA-23rh-xw42-fq82
Packagist	pimcore/pimcore	12.3.10	GHSA-23rh-xw42-fq82
Packagist	pimcore/pimcore	11.5.19	GHSA-23rh-xw42-fq82

Affected products (as reported)

Vendor	Product	Versions
pimcore	pimcore	< 11.5.19>= 12.0.0, < 12.3.10>= 2026.1.0, < 2026.1.6

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/pimcore/pimcore/security/advisories/GHSA-23rh-xw42-fq82 x_refsource_CONFIRM
https://github.com/pimcore/pimcore/pull/19175 x_refsource_MISC
https://github.com/pimcore/pimcore/commit/1999fee27ed0d027ad5b8195ecf6e27243729530 x_refsource_MISC
https://github.com/pimcore/pimcore/releases/tag/v12.3.10 x_refsource_MISC
https://github.com/pimcore/pimcore/releases/tag/v2026.1.6 x_refsource_MISC