Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration
Date: 2026-05
Affected: composer/pimcore/pimcore
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-44739
CWE: CWE-89
CVSS: 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N)

### Summary The columnConfigAction endpoint in the CustomReportsBundle is vulnerable to SQL injection. An attacker with the reports_config permission can supply a malicious SQL configuration that is concatenated into a query and executed. Although the application attempts to filter certain DDL/DML keywords (like UPDATE, DELETE, DROP), it fails to prevent arbitrary SELECT queries, UNION statements, or the use of dangerous database functions. Furthermore, because the application returns database error messages in the JSON response, an attacker can easily exfiltrate data using error-based SQL injection techniques. ### Affected scope bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php CustomReportController:columnConfigAction -> SqlAdapter::getColumns -> SqlAdapter::buildQueryString -> Db::fetchAssociative() ### Details * The columnConfigAction endpoint in ``` bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php:197 ``` receives a configuration JSON string from the request body. * The configuration is decoded and the first element is extracted in ```bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php:207-208.``` * The Sql adapter is instantiated based on the user-controlled type field in ```bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php:216.``` * The controller calls getColumnsWithMetadata in ```bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php:


Mitigations:

Architectural layers (MAESTRO):