CVE-2026-55416

Executive Summary

CVE-2026-55416 is an authenticated SQL injection vulnerability in Pimcore, an Open Source Data & Experience Management Platform, affecting versions prior to 11.5.19, 12.3.10, and 2026.1.6. An attacker holding the reports_config permission can inject attacker-controlled SQL fragments into the sql, from, where, and groupby fields of a Custom Reports configuration, which are concatenated into a database query by bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php. With a CVSS score of 8.8 (High), successful exploitation permits disclosure, modification, or deletion of arbitrary database data.

Technical Analysis

The vulnerability resides in the Custom Reports subsystem of Pimcore, specifically within bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php. The buildQueryString() method assembles a database query by directly concatenating the user-supplied sql, from, where, and groupby configuration fields. Rather than using parameterized queries or a strict allow-list, the implementation relies on a blacklist that omits several dangerous SQL constructs — specifically additional data-manipulation statements, comments, subqueries, and multiple statements. Because blacklists are inherently incomplete and bypassable, this design fails to prevent injection.

A second flaw is noted in the getData() method, which previously interpolated offset and limit values directly into a LIMIT clause without integer casting. This creates an additional injection path through numeric parameters that should be trivial to sanitize but were not.

The attack surface is the Custom Reports configuration and execution workflow. It requires authentication and the reports_config permission — a privilege typically assigned to administrative or reporting-focused users, not anonymous visitors. This precondition reduces the attack surface but does not eliminate risk, as it enables privilege escalation from a reporting role to full database read/write access.

When a configured report is executed, the constructed query reaches fetchAllAssociative(). Since the blacklist permits subqueries, comments, and stacked/compound statements in the described threat model, an attacker can craft payloads that survive filtering and execute arbitrary SQL against the underlying database. The CVSS vector confirms network reachability (AV:N), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and high confidentiality, integrity, and availability impact (C:H/I:H/A:H).

The root cause class is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command / SQL Injection), specifically an authenticated, blacklist-bypass injection through configuration-controlled query fragments.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-55416. The following attack chain is inferred strictly from the vulnerability class and the details in the NVD description.

1. Reconnaissance and Target Identification. The attacker identifies an internet- or intranet-exposed Pimcore instance running an affected version (prior to 11.5.19, 12.3.10, or 2026.1.6). Identification may be performed passively (banner/fingerprint via Shodan dorks such as http.title:"Pimcore" or http.html:"pimcore") or through prior knowledge of the target's CMS. The attacker must possess valid credentials with the reports_config permission — obtained through credential stuffing, phishing, an insider threat, or a separate privilege-escalation path.

2. Triggering the Flaw Class. Using the Custom Reports configuration interface, the attacker supplies crafted values in one or more of the sql, from, where, or groupby fields. Because the blacklist omits data-manipulation statements, comments, subqueries, and multiple statements, the attacker encodes a payload that evades the filter — for example, by leveraging subqueries or comment syntax that the blacklist does not reject. The buildQueryString() method concatenates these values into the backend query without parameterization. If exploiting the LIMIT interpolation path, the attacker supplies a non-integer offset or limit value that the getData() method concatenates without casting.

3. Payload Execution Method. The attacker saves and executes the configured report. Upon execution, the constructed query is passed to fetchAllAssociative(), which runs it against the database. At this stage the injected fragment executes with the privileges of the Pimcore database user.

4. Post-Exploitation Impact. Depending on payload and database permissions, the attacker can disclose sensitive data (user credentials, session tokens, PII, business records), modify or delete arbitrary data (integrity/availability impact), and potentially pivot to further attacks. As the vector ratings indicate high confidentiality, integrity, and availability impact, the blast radius includes the full database.

Because no public exploit exists, defenders should not assume low risk; the technical preconditions (authenticated reporting user) are commonly satisfied in enterprise deployments where multiple staff hold reporting privileges.

Impact Assessment

Business impact is severe. The CVSS base score of 8.8 reflects network-exploitable (AV:N), low-complexity (AC:L) attack conditions requiring only low privileges (PR:L) and no user interaction (UI:N). Confidentiality, integrity, and availability impacts are all rated High. An authenticated reporting user can therefore read, alter, or destroy arbitrary database records — ranging from CMS content to user accounts and any business data stored in the same database schema.

The most realistic near-term impact is data exfiltration (credentials, customer records, intellectual property) and destructive tampering (deletion or corruption of content and configuration). Because the database account backing Pimcore frequently has broad privileges over the application schema, the effective blast radius is the entire Pimcore database. If that schema shares a database instance with other applications, lateral exposure is possible.

Affected systems are Pimcore deployments on versions prior to 11.5.19, 12.3.10, and 2026.1.6. The vulnerability is authenticated, so it is primarily an insider-threat or post-compromise escalation vector rather than an unauthenticated external attack path. That said, once any reporting-capable account is compromised, the impact is equivalent to full database compromise. EPSS is 0.00606 (47.2nd percentile), indicating low near-term exploitation likelihood based on current public signals — consistent with the absence of public PoC or KEV listing — but EPSS does not account for targeted, authenticated attacks where exploit code remains private.

No CISA KEV listing and no public exploit code were observed, which reduces immediate mass-exploitation risk while leaving targeted risk intact.

Detection Guidance

Detection should focus on anomalous Custom Reports configuration changes and on SQL statements reaching the database that deviate from expected report patterns (subqueries, comment syntax, stacked statements, non-integer LIMIT values).

Sigma Rule

title: Pimcore Custom Reports SQL Injection Attempt (CVE-2026-55416)
id: 9f7c2a41-5b3e-4d8e-9a1c-7e2f4b6c8d10
status: experimental
description: Detects creation or modification of Pimcore Custom Reports configurations containing SQL metacharacters or blacklist-evading constructs associated with CVE-2026-55416.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-55416
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  product: pimcore
  service: application
detection:
  selection_event:
    event.action:
      - "custom_report.create"
      - "custom_report.update"
      - "custom_report.save"
  selection_sqli:
    - report_config.sql|contains:
        - "--"
        - "/*"
        - "*/"
        - ";"
        - "union"
        - "select"
    - report_config.where|contains:
        - "--"
        - "/*"
        - "union"
        - "select"
    - report_config.from|contains:
        - "--"
        - "/*"
        - "union"
    - report_config.groupby|contains:
        - "--"
        - "/*"
        - "union"
  condition: selection_event and selection_sqli
falsepositives:
  - Legitimate complex report definitions authored by trusted administrators
level: high
tags:
  - attack.t1190
  - cve.2026.55416

YARA Rule

rule CVE_2026_55416_Pimcore_CustomReports_SQLi
{
    meta:
        description = "Detects SQL injection fragments in Pimcore Custom Reports configuration or Sql.php adapter artifacts"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-55416"
        date = "2026-01-01"
        cve = "CVE-2026-55416"

    strings:
        $f1 = "CustomReportsBundle/src/Tool/Adapter/Sql.php" ascii wide
        $f2 = "buildQueryString" ascii wide
        $f3 = "fetchAllAssociative" ascii wide
        $s1 = "sql" ascii wide
        $s2 = "groupby" ascii wide
        $p1 = /(union[\s\S]{0,20}select)/ nocase ascii
        $p2 = /(--|\/\*)[\s\S]{0,40}(where|from|groupby)/ nocase ascii
        $p3 = /;\s*(drop|delete|update|insert)\s/i ascii

    condition:
        2 of ($f*) and 1 of ($s*) and 1 of ($p*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-55416 Pimcore Custom Reports SQL Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"custom_report"; nocase; http.request_body; content:"groupby"; nocase; http.request_body; pcre:"/(union[\s\S]{0,20}select|--|\/\*|;\s*(drop|delete|update|insert))/i"; reference:cve,2026-55416; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-55416; classtype:web-application-attack; sid:2026554160; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [http.request where http.request.method == "POST" and
       url.path contains "custom_report"]
  [http.request where http.request.body contains "groupby" and
       (http.request.body contains "union" or
        http.request.body contains "--" or
        http.request.body contains "/*" or
        http.request.body contains ";")]

Splunk SPL Query

index=web OR index=pimcore
| search "CustomReportsBundle" OR "custom_report"
| eval body=coalesce(http_request_body, request_body, _raw)
| where match(body, "(?i)(groupby|from|where)") AND match(body, "(?i)(union[\s\S]{0,20}select|--|\/\*|;\s*(drop|delete|update|insert))")
| stats count min(_time) as first_seen max(_time) as last_seen values(user) as users values(src_ip) as src_ips by host, uri_path
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="pimcore,web,sql_injection,">
  <rule id="2026554" level="12">
    <if_sid>31100</if_sid>
    <field name="url">custom_report</field>
    <regex type="pcre2">(?i)(union.{0,20}select|--|\/\*|;\s*(drop|delete|update|insert))</regex>
    <description>CVE-2026-55416: Possible Pimcore Custom Reports SQL injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_55416,attack.sql_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in 11.5.19, 12.3.10, and 2026.1.6, but no vendor advisory, commit, or tracked patch source corroborated this within the supplied data. Until patch verification is completed, treat the following as precautionary.

1. Immediate Mitigations.

   • Restrict and audit the reports_config permission. Grant it only to fully trusted administrators and remove it from reporting-only or departmental accounts.
   • Rotate credentials for any account holding reports_config, and enforce strong authentication (MFA) on all administrative accounts.
   • Review all existing Custom Reports configurations for suspicious sql, from, where, or groupby values containing comments, subqueries, or multiple statements; export and inspect them out-of-band.
   • Where feasible, temporarily disable the Custom Reports feature or block access to the Custom Reports configuration interface until patches are validated.
   • Apply database least privilege: ensure the Pimcore database user cannot execute stacked DML/DDL beyond what the application requires, and remove unnecessary privileges.

2. Patch/Upgrade Steps.

   • Upgrade to Pimcore 11.5.19, 12.3.10, or 2026.1.6 (or later) as indicated by the NVD description. Confirm the release notes and changelog directly from the vendor before relying on the fix, given the 0/4 patch confidence.
   • Verify the installed version after upgrade and re-audit Custom Reports configurations for residual malicious entries.
   • If upgrade cannot be performed immediately, combine the immediate mitigations above and treat the system as at-risk.

3. Long-Term Hardening.

   • Replace blacklist-based SQL filtering with parameterized queries and strict allow-listing of report fields; this is the architectural fix class for CWE-89.
   • Enforce integer casting for offset and limit in getData() and all numeric query parameters.
   • Implement code review and static analysis (SAST) gates on report/adapter code paths to catch string-concatenated queries.
   • Monitor for anomalous SQL reaching the database via database audit logging, and alert on subqueries, comments, and stacked statements in report-originated queries.

References

• NVD — CVE-2026-55416: https://nvd.nist.gov/vuln/detail/CVE-2026-55416
• CWE-89 — Improper Neutralization of Special Elements used in an SQL Command: https://cwe.mitre.org/data/definitions/89.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Pimcore project repository and release notes (verify fixed versions 11.5.19, 12.3.10, 2026.1.6 directly with the vendor): https://github.com/pimcore/pimcore
• FIRST EPSS — CVE-2026-55416 scoring (0.00606, ~47.2nd percentile): https://api.first.org/data/v1/epss?cve=CVE-2026-55416

Threat actor campaign and exploit-in-the-wild evidence: none observed. No CISA KEV entry, no public PoC, no Nuclei template, and no published exploit code were identified. The attack chain above is inferred from the vulnerability class (authenticated SQL injection via configuration-controlled query fragments) and from the technical details provided in the NVD description.