Read the docs
TI-2026-32626 Aliases CVE-2026-44739GHSA-3234-gxc3-pq6f

Pimcore: SQL Injection in Custom Reports Column Configuration

Priority HIGH 73CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, the columnConfigAction endpoint in bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php passes malicious SQL configuration through CustomReportController:columnConfigAction, SqlAdapter::getColumns, SqlAdapter::buildQueryString, and Db::fetchAssociative(), allowing an attacker with the reports_config permission to use arbitrary SELECT queries, UNION statements, dangerous database functions, and error-based SQL injection to exfiltrate or manipulate database data. This issue is fixed in versions 11.5.17 (LTS) and 12.3.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00392 33rd percentileScored 2026-11-07
Fix Fixed pimcore (pimcore): 11.5.17, 12.3.6pimcore/pimcore (Packagist): 2026.1.2, 11.5.17, 12.3.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pimcorepimcorebefore 11.5.17; 12.0.0 to before 12.3.611.5.17, 12.3.6Patch availableCNA
—pimcore/pimcore (Packagist)2026.1.0 to before 2026.1.22026.1.2Patch availableGHSA-3234-gxc3-pq6f
—pimcore/pimcore (Packagist)before 11.5.1711.5.17Patch availableGHSA-3234-gxc3-pq6f
—pimcore/pimcore (Packagist)12.0.0-RC1 to before 12.3.612.3.6Patch availableGHSA-3234-gxc3-pq6f
  • pimcore Vendorpimcore Affected before 11.5.17; 12.0.0 to before 12.3.6 Fixed in 11.5.17, 12.3.6 Patch available CNA
  • pimcore/pimcore (Packagist) Vendor— Affected 2026.1.0 to before 2026.1.2 Fixed in 2026.1.2 Patch available GHSA-3234-gxc3-pq6f
  • pimcore/pimcore (Packagist) Vendor— Affected before 11.5.17 Fixed in 11.5.17 Patch available GHSA-3234-gxc3-pq6f
  • pimcore/pimcore (Packagist) Vendor— Affected 12.0.0-RC1 to before 12.3.6 Fixed in 12.3.6 Patch available GHSA-3234-gxc3-pq6f

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*——pimcore
  • cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:* Versions — — ·pimcore

Remediation

  • Fix · CNA pimcore (pimcore) Fixed in 11.5.17, 12.3.6
  • Fix · GHSA-3234-gxc3-pq6f pimcore/pimcore (Packagist) Fixed in 2026.1.2 Advisory →
  • Fix · GHSA-3234-gxc3-pq6f pimcore/pimcore (Packagist) Fixed in 11.5.17 Advisory →
  • Fix · GHSA-3234-gxc3-pq6f pimcore/pimcore (Packagist) Fixed in 12.3.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44739
  2. 2026-10-03 Alias added: GHSA-3234-gxc3-pq6f

References

Other 5

  • TI-2026-18925 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848 CVSS 3.1HIGH 8.8
  • TI-2024-15667 Pimcore Admin Classic Bundle host header injection in the password reset CVSS 3.1HIGH 8.8
  • TI-2026-40161 Pimcore: Remote Code Execution via DataObject Class-Definition Field Name CVSS 3.1CRITICAL 9.9
  • TI-2026-18926 Pimcore ENV Variables and Cookie Informations are exposed in http_error_log CVSS 3.1HIGH 8.6
  • TI-2024-16853 Pimcore Host Header Injection in user invitation link CVSS 3.1CRITICAL 9.3
  • TI-2023-01489 SQL Injection in pimcore/pimcore CVSS 3.1HIGH 8.8
See all 171 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences