An authenticated SQL injection vulnerability in Pimcore allows attackers with reports_config permissions to manipulate database queries, leading to full data compromise or unauthorized modification.

This is an SQL injection vulnerability (CWE-89) located in the Custom Reports configuration component. An authenticated user with sufficient privileges can inject malicious SQL fragments into report fields, which are then concatenated into database queries and executed by the application.

Successful exploitation of this vulnerability grants an attacker the ability to disclose, modify, or delete sensitive data stored within the Pimcore database. With a CVSS score of 8.8, this flaw represents a high risk of significant data breach and loss of integrity for business-critical information, potentially leading to operational disruption or regulatory non-compliance.

Immediate Action: Update Pimcore to version 11.5.19, 12.3.10, or 2026.1.6 depending on the active release branch.

Proactive Monitoring: Review application logs for unusual database error patterns or unexpected query structures originating from the Custom Reports module.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, such as unauthorized subqueries or data-manipulation keywords, within application parameters.

Public Exploit Available: No

Given the high severity of this vulnerability and the potential for full database compromise, organizations should prioritize patching as part of their next maintenance cycle. Administrators must verify that only authorized users possess the reports_config permission to further reduce the risk of exploitation while the update is being deployed.