SQL Injection Vulnerability in Pimcore Data Management Platform
CVE-2026-55416
What is CVE-2026-55416?
An SQL injection vulnerability exists in Pimcore's Data & Experience Management Platform, where authenticated users with specific permissions can inject malicious SQL fragments. This occurs in the Custom Reports configuration, allowing attackers to manipulate database queries via improperly sanitized input fields. The vulnerability enables unauthorized data disclosure, modification, or deletion through crafted SQL commands, particularly affecting the execution of report queries. To mitigate this issue, users are advised to upgrade to versions 11.5.19, 12.3.10, or 2026.1.6, which include patches against these security flaws.
Affected Version(s)
pimcore < 11.5.19 < 11.5.19
pimcore >= 12.0.0, < 12.3.10 < 12.0.0, 12.3.10
pimcore >= 2026.1.0, < 2026.1.6 < 2026.1.0, 2026.1.6