Description

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reports_config permission can place attacker-controlled SQL fragments in the sql, from, where, and groupby fields of a Custom Reports configuration processed by bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php. The buildQueryString() method concatenates these values into a database query, while a blacklist omits dangerous constructs such as additional data-manipulation statements, comments, subqueries, and multiple statements. The getData() method also previously interpolated offset and limit values into a LIMIT clause without integer casting. Executing the configured report reaches fetchAllAssociative() with the constructed query and can disclose, modify, or delete arbitrary database data. This issue is fixed in versions 11.5.19, 12.3.10, and 2026.1.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-14T17:17:48.220Z",
  "pubdate": "2026-09-14T17:17:48.220Z",
  "executiveSummary": "Pimcore versions prior to 11.5.19, 12.3.10, and 2026.1.6 are susceptible to a critical SQL injection vulnerability within the Custom Reports functionality. The flaw originates from the improper handling of user-supplied input in database queries constructed through the CustomReportsBundle.\nAn authenticated user possessing the 'reports_config' permission can inject malicious SQL fragments into specific configuration fields. This vulnerability allows for unauthorized data disclosure, modification, or deletion, effectively compromising the integrity and confidentiality of the underlying database. The attack vector requires authenticated access with specific report configuration privileges, which limits the initial access surface but provides significant post-exploitation capabilities within the database environment.\nThe risk is severe as it enables arbitrary SQL execution, potentially leading to full administrative control over the application's data layer. Users are advised to upgrade to the specified patched versions immediately to remediate this flaw.",
  "technicalDetails": "The vulnerability resides within the 'bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php' component of Pimcore. The root cause of the SQL injection is the insecure concatenation of user-controlled input into database query strings within the 'buildQueryString()' method.\nThe application processes various report configuration parameters, specifically the 'sql', 'from', 'where', and 'groupby' fields, directly into the final SQL statement sent to the database. While the application implements a blacklist to filter dangerous constructs such as subqueries, comments, and stacked queries, this mechanism is inherently insufficient to prevent sophisticated injection attacks. Furthermore, the 'getData()' method exhibits an additional flaw where 'offset' and 'limit' parameters are interpolated directly into the query's LIMIT clause without proper integer casting, providing an additional vector for query manipulation.\nThe exploitation flow is as follows: 1) An attacker authenticates to the Pimcore platform with the 'reports_config' permission. 2) The attacker navigates to the Custom Reports configuration interface. 3) The attacker supplies malicious SQL fragments within the designated input fields. 4) Upon report execution, the 'buildQueryString()' method concatenates these malicious inputs into a raw SQL query. 5) The resulting query is passed to the database via 'fetchAllAssociative()'. Because the input sanitization relies on a blacklist rather than parameterized queries or prepared statements, the attacker can bypass these filters to execute arbitrary commands.\nThe lack of integer casting on the 'offset' and 'limit' parameters allows an attacker to break out of the intended query context by injecting non-numeric characters, potentially enabling blind SQL injection techniques or further logical manipulation of the query structure. The post-exploitation impact includes unauthorized data exfiltration, modification of existing records, or deletion of database tables, depending on the permissions granted to the database user account executing the query. This flaw affects Pimcore versions prior to 11.5.19, 12.3.10, and 2026.1.6."
}