CVE-2026-55416

Pimcore's Custom Reports bundle contains an authenticated SQL injection flaw (CWE-89, CVSS 8.8 high) in which the report configuration fields (sql, from, where, groupby) are concatenated directly into database queries and guarded only by a regex blacklist that omits INSERT, UNION, subqueries, stacked queries, LOAD_FILE(), INTO OUTFILE, and MySQL comment injection. An attacker holding the reports_config permission and a valid admin session triggers it by submitting crafted SQL via POST to /admin/bundle/customreports/custom-report/update; an unparameterized LIMIT clause (offset/limit) provides a secondary injection point. Because the injected SQL runs with the application's database privileges, the attacker can read, modify, or delete data across the entire database, resulting in complete data compromise. Any Pimcore deployment running 11.5.x, 12.3.x, or 2026.1.x prior to the patched releases and using the Custom Reports bundle is affected. No public proof-of-concept or in-the-wild exploitation is known, and the flaw is not in CISA KEV.

What to do: Upgrade to Pimcore 11.5.19, 12.3.10, or 2026.1.6 depending on your release line. As interim mitigation, restrict the reports_config permission to a small set of highly trusted administrators and, if a WAF is available, block requests to /admin/bundle/customreports/custom-report/update whose configuration parameter contains SQL keywords. Also review stored custom report configurations and admin accounts with reports_config access for signs of tampering.