Pimcore’s columnConfigAction endpoint in the CustomReportsBundle is vulnerable to an unfiltered SQL injection. The flaw originates when a user with the reports_config permission submits a malicious column configuration; the payload is passed through CustomReportController:columnConfigAction, SqlAdapter::getColumns, SqlAdapter::buildQueryString, and Db::fetchAssociative(), allowing the attacker to execute arbitrary SELECT statements, UNION clauses, dangerous database functions, and error‑based SQL injection. This capability enables an attacker to read sensitive data, manipulate or delete records, thus compromising the confidentiality and integrity of the platform’s data. The vulnerability is classified as CWE‑89 and has a CVSS score of 8.7.

The issue affects the Pimcore Open Source Data & Experience Management Platform. All releases prior to 11.5.17 (the Long‑Term Support line) and prior to 12.3.6 are susceptible. Revisions 11.5.17, 12.3.6, and later contain a fix that sanitises the input and prevents arbitrary SQL execution.

The CVSS score of 8.7 indicates high severity potential, while the EPSS score of less than 1% suggests that the likelihood of real‑world exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires HTTP access to the columnConfigAction endpoint and the reports_config permission; thus the attack vector is inferred to be remote with privileged user access, but the success depends on the attacker’s ability to obtain or abuse that permission. Once the condition is met, the attacker can execute the injection to exfiltrate or manipulate data.