{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/pimcore--2026.1.0--2026.1.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*"],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Pimcore (\u003e= 2026.1.0, \u003c= 2026.1.5)","Pimcore (\u003e= 12.0.0, \u003c= 12.3.9)","Pimcore (\u003c 11.5.18)"],"_cs_severities":["high"],"_cs_tags":["sql-injection","web-application","cms"],"_cs_type":"advisory","_cs_vendors":["Pimcore"],"content_html":"\u003cp\u003ePimcore is susceptible to a high-severity SQL injection vulnerability identified as CVE-2026-55416, affecting the \u003ccode\u003eCustomReportsBundle\u003c/code\u003e. The issue originates in the \u003ccode\u003eSql.php\u003c/code\u003e adapter, where user-supplied configuration fields - specifically \u003ccode\u003esql\u003c/code\u003e, \u003ccode\u003efrom\u003c/code\u003e, \u003ccode\u003ewhere\u003c/code\u003e, and \u003ccode\u003egroupby\u003c/code\u003e - are concatenated directly into database queries. While the application implements a regex-based blacklist to filter malicious keywords, the current implementation is insufficient. It fails to block critical SQL injection primitives such as \u003ccode\u003eUNION SELECT\u003c/code\u003e, \u003ccode\u003eINSERT\u003c/code\u003e, subqueries, and MySQL comment injection.\u003c/p\u003e\n\u003cp\u003eAn attacker with \u003ccode\u003ereports_config\u003c/code\u003e privileges can manipulate these report configuration parameters to gain unauthorized access to the database, including the potential to read, modify, or delete sensitive data. Furthermore, the application fails to cast \u003ccode\u003e$offset\u003c/code\u003e and \u003ccode\u003e$limit\u003c/code\u003e parameters to integers, introducing a secondary injection vector via the LIMIT clause. This vulnerability affects multiple branches of Pimcore, including versions within the 2026.x, 12.x, and 11.x release lines.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker obtains an authenticated session with \u003ccode\u003ereports_config\u003c/code\u003e permissions.\u003c/li\u003e\n\u003cli\u003eAttacker initiates an HTTP POST request to \u003ccode\u003e/admin/bundle/customreports/custom-report/update\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker embeds malicious SQL payloads within the \u003ccode\u003econfiguration\u003c/code\u003e JSON object fields (e.g., \u003ccode\u003esql\u003c/code\u003e, \u003ccode\u003ewhere\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eCustomReportController::updateAction\u003c/code\u003e decodes the input and persists the malicious configuration to the \u003ccode\u003ecustom_reports\u003c/code\u003e database table.\u003c/li\u003e\n\u003cli\u003eThe application triggers a data retrieval process, calling \u003ccode\u003eTool\\Config::getByName()\u003c/code\u003e to load the configuration.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eSql::buildQueryString\u003c/code\u003e method concatenates the malicious input strings to form a query, bypassing the incomplete regex filter.\u003c/li\u003e\n\u003cli\u003eThe final query is executed via \u003ccode\u003e$db-\u0026gt;fetchAllAssociative($sql)\u003c/code\u003e, executing the attacker's arbitrary SQL commands.\u003c/li\u003e\n\u003cli\u003eAttacker retrieves sensitive data or modifies records through the malicious report interface.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full database compromise. Attackers can exfiltrate sensitive user data, bypass authentication controls, or alter application state. The vulnerability is accessible to any user granted the \u003ccode\u003ereports_config\u003c/code\u003e permission, which is typically assigned to administrative or reporting roles.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003ePatch Pimcore immediately by upgrading to versions 2026.1.6, 12.3.10, or 11.5.19 or later.\u003c/li\u003e\n\u003cli\u003eReview and restrict the \u003ccode\u003ereports_config\u003c/code\u003e permission to the smallest necessary set of trusted administrative users.\u003c/li\u003e\n\u003cli\u003eDeploy WAF rules to inspect POST requests to \u003ccode\u003e/admin/bundle/customreports/custom-report/update\u003c/code\u003e for SQL injection patterns, specifically targeting common clauses like \u003ccode\u003eUNION\u003c/code\u003e, \u003ccode\u003eSELECT\u003c/code\u003e, and \u003ccode\u003eINFORMATION_SCHEMA\u003c/code\u003e in the \u003ccode\u003econfiguration\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003eDetection engineers should audit web server logs for suspicious database query patterns originating from the custom reports module.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-11T00:55:23Z","date_published":"2026-09-11T00:55:23Z","id":"https://feed.craftedsignal.io/briefs/2026-09-pimcore-sql-injection/","summary":"An authenticated SQL injection vulnerability in Pimcore's CustomReportsBundle allows users with specific permissions to execute arbitrary database commands by bypassing a weak keyword blacklist.","title":"SQL Injection in Pimcore CustomReportsBundle","url":"https://feed.craftedsignal.io/briefs/2026-09-pimcore-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Pimcore (\u003e= 2026.1.0, \u003c= 2026.1.5)","version":"https://jsonfeed.org/version/1.1"}