Read the docs
TI-2026-39786 Aliases CVE-2026-55082

DHIS2 SQL injection in SQL View filter values

Priority MEDIUM 40CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticated users with SQL View access to provide crafted filter values that were interpolated into generated SQL. An authenticated user with access to SQL View execution could manipulate SQL generated for SQL View filters and potentially access data outside the intended SQL View result set. This is distinct from CVE-2026-55084, which tracks the related SQL View filter column-name injection. Known affected release lines for this advisory: DHIS2 2.37, 2.38, and 2.39 before the 2026-06-09 EOS security updates. Patched by the 2026-06-09 EOS security updates for 2.37, 2.38, and 2.39. The same value-slot hardening was already present on later supported branches through DHIS2-20174 / PR #22253.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00581 48th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dhis2dhis2-core= 2.37; = 2.38; = 2.39—No fix listedCNA
  • dhis2-core Vendordhis2 Affected = 2.37; = 2.38; = 2.39 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:dhis2:dhis_2:*:*:*:*:*:*:*:*——dhis2
  • cpe:2.3:a:dhis2:dhis_2:*:*:*:*:*:*:*:* Versions — — ·dhis2

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55082

References

Other 5

  • TI-2026-39787 DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.1
  • TI-2022-08660 SQL Injection in DHIS2's in OrgUnit program association CVSS 3.1HIGH 8.8
  • TI-2021-16565 SQL Injection in DHIS2 Tracker API CVSS 3.1HIGH 8.8
  • TI-2026-39788 SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read CVSS 3.1HIGH 8.8
  • TI-2021-18026 SQL Injection in DHIS2 Tracker API CVSS 3.1HIGH 8.8
  • TI-2021-12372 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dhis2-core CVSS 3.1HIGH 8.8
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences