CVE-2026-44739: Pimcore

High severity, CVSS 8.7. EPSS: 0.4% chance of exploitation in the next 30 days.

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, the columnConfigAction endpoint in bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php passes malicious SQL configuration through CustomReportController:columnConfigAction, SqlAdapter::getColumns, SqlAdapter::buildQueryString, and Db::fetchAssociative(), allowing an attacker with the reports_config permission to use arbitrary SELECT queries, UNION statements, dangerous database functions, and error-based SQL injection to exfiltrate or manipulate database data. This issue is fixed in versions 11.5.17 (LTS) and 12.3.6.

Affected products

• Pimcore Pimcore: before 11.5.17 (fixed in 11.5.17); from 12.0.0, before 12.3.6 (fixed in 12.3.6)

Published 2026-07-17. Last modified 2026-07-22.