CVE-2026-55416

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reports_config permission can place attacker-controlled SQL fragments in the sql, from, where, and groupby fields of a Custom Reports configuration processed by bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php. The buildQueryString() method concatenates these values into a database query, while a blacklist omits dangerous constructs such as additional data-manipulation statements, comments, subqueries, and multiple statements. The getData() method also previously interpolated offset and limit values into a LIMIT clause without integer casting. Executing the configured report reaches fetchAllAssociative() with the constructed query and can disclose, modify, or delete arbitrary database data. This issue is fixed in versions 11.5.19, 12.3.10, and 2026.1.6.

• CWE-89

• https://github.com/pimcore/pimcore/commit/1999fee27ed0d027ad5b8195ecf6e27243729530
• https://github.com/pimcore/pimcore/pull/19175
• https://github.com/pimcore/pimcore/releases/tag/v12.3.10
• https://github.com/pimcore/pimcore/releases/tag/v2026.1.6
• https://github.com/pimcore/pimcore/security/advisories/GHSA-23rh-xw42-fq82

Published

Sep 14, 2026

Last Modified

Sep 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5541A vulnerability was found in code-projects Simple Laundry Sy…4.3
• CVE-2026-55410NocoBase is an AI-powered no-code/low-code platform for buil…6.7
• CVE-2026-55411ToolJet is the open-source foundation am AI-native platform …6.8
• CVE-2026-55412ToolJet is the open-source foundation am AI-native platform …8.3
• CVE-2026-55413ToolJet is the open-source foundation am AI-native platform …9.4
• CVE-2026-55415datamodel-code-generator generates Pydantic v2 models, datac…7.5
• CVE-2026-55417Chevereto is a self-hosted media-sharing platform. Starting …6.9
• CVE-2026-55418FastGPT is an open source AI knowledge base platform. Prior …8.6
• CVE-2026-55419Reachy Mini is an SDK for controlling Reachy Mini robots. Pr…5.3
• CVE-2026-5542A vulnerability was determined in code-projects Simple Laund…4.3
• CVE-2026-55420Discourse is an open-source discussion platform. Prior to 20…8.1
• CVE-2026-55421Open edX Platform enables the authoring and delivery of onli…6.8