CVE-2026-44739Disclosure

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, the columnConfigAction endpoint in bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php passes malicious SQL configuration through CustomReportController:columnConfigAction, SqlAdapter::getColumns, SqlAdapter::buildQueryString, and Db::fetchAssociative(), allowing an attacker with the reports_config permission to use arbitrary SELECT queries, UNION statements, dangerous database functions, and error-based SQL injection to exfiltrate or manipulate database data. This issue is fixed in versions 11.5.17 (LTS) and 12.3.6.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://www.valtersit.com/cve/CVE-2026-44739/

Full discourse1 post

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters92d
Disclosure
#CVE-2026-44739 - #SQLi in Pimcore. Attackers with reports_config permission can execute arbitrary SELECT/UNION queries. #CVSS 8.7. No patch yet. Monitor and restrict access. #CVEAlert #Pimcore #infosec #devsecops #devops #developer https://www.valtersit.com/cve/CVE-2026-44739/
Post summary
A new SQL injection vulnerability (CVE-2026-44739) in Pimcore permits attackers with reports_config permission to execute arbitrary SELECT/UNION queries. No patch is available yet; users should monitor and restrict access.
0000050
984 followersView on X

Explore more

Back to dashboard