Pimcore’s column configuration endpoint in CustomReportsBundle is vulnerable to unfiltered SQL injection. When a user with the reports_config permission submits a crafted column configuration, the injector can cause the system to execute arbitrary SELECT statements, UNION clauses, dangerous database functions, and error‑based SQL injections. This flaw allows an attacker to read sensitive data from the database, modify or delete records, and generally compromise the confidentiality and integrity of the platform’s data. The vulnerability is classified as CWE‑89 and is scored at CVSS 8.7.

The issue affects the Pimcore Open Source Data & Experience Management Platform. All releases prior to 11.5.17 (the Long‑Term Support line) and prior to 12.3.6 are susceptible. Revisions 11.5.17, 12.3.6, and later contain a fix that sanitises the input and prevents arbitrary SQL execution.

The CVSS score of 8.7 indicates a high severity potential, while the EPSS score of less than 1% suggests that the likelihood of real‑world exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires HTTP access to the columnConfigAction endpoint and the reports_config permission; thus the attack vector is inferred to be remote with privileged user access, but the success depends on the attacker’s ability to obtain or abuse that permission. Once the condition is met, the attacker can execute the injection to exfiltrate or manipulate data.