SQL injection in Pimcore - CVE-2026-55416
Published: September 17, 2026
Vulnerability identifier: #VU150532
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-55416
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to read, modify, or delete database data.
The vulnerability exists due to improper neutralization of special elements in an SQL command in the Custom Reports bundle Sql adapter\'s buildQueryString() method when processing report configuration fields. A remote user can submit a malicious report configuration to read, modify, or delete database data.
Exploitation requires the reports_config permission.
Affected software
Pimcore
How to mitigate CVE-2026-55416
Install security update from vendor's website.
Pimcore - addressed in versions 12.3.10, 2026.1.6