CVE-2026-55082: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dhis2 dhis2-core
DHIS2-core versions 2.37, 2.38, and 2.39 prior to the 2026-06-09 EOS security updates contain an SQL injection vulnerability in the SQL View data endpoints. Authenticated users with SQL View access could craft filter values that are improperly neutralized and interpolated into SQL queries, potentially allowing access to data outside the intended result set. This vulnerability is distinct from a related injection issue tracked as CVE-2026-55084. The issue was patched in the 2026-06-09 EOS security updates for the affected versions, and later supported branches had this hardening already applied.
AI Analysis
Technical Summary
CVE-2026-55082 is an SQL injection vulnerability in dhis2-core affecting versions 2.37, 2.38, and 2.39 before the 2026-06-09 EOS security updates. The vulnerability arises because authenticated users with SQL View execution access can supply crafted filter values that are directly interpolated into generated SQL commands without proper neutralization. This allows manipulation of the SQL query logic and potential unauthorized data access beyond the intended SQL View result set. The vulnerability is distinct from CVE-2026-55084, which involves injection via filter column names. The issue was addressed by the 2026-06-09 EOS security updates, which introduced value-slot hardening to prevent such injection attacks. Later supported branches had this protection already in place via DHIS2-20174 / PR #22253.
Potential Impact
An authenticated user with SQL View execution privileges can exploit this vulnerability to manipulate SQL queries by injecting crafted filter values. This can lead to unauthorized access to data outside the intended SQL View result set, potentially exposing sensitive information. The vulnerability has a high CVSS 4.0 score of 8.7, indicating a significant risk if exploited.
Mitigation Recommendations
Apply the 2026-06-09 EOS security updates for DHIS2 versions 2.37, 2.38, and 2.39 to remediate this vulnerability. These updates include hardening of the value slots used in SQL View filters to prevent SQL injection. For later supported branches, the fix is already present. No additional mitigation steps are indicated by the vendor advisory.
CVE-2026-55082: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dhis2 dhis2-core
Description
DHIS2-core versions 2.37, 2.38, and 2.39 prior to the 2026-06-09 EOS security updates contain an SQL injection vulnerability in the SQL View data endpoints. Authenticated users with SQL View access could craft filter values that are improperly neutralized and interpolated into SQL queries, potentially allowing access to data outside the intended result set. This vulnerability is distinct from a related injection issue tracked as CVE-2026-55084. The issue was patched in the 2026-06-09 EOS security updates for the affected versions, and later supported branches had this hardening already applied.
CVSS v4.0
Score 8.7high
Affected software
pkg:github/dhis2/dhis2-coreRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-55082 is an SQL injection vulnerability in dhis2-core affecting versions 2.37, 2.38, and 2.39 before the 2026-06-09 EOS security updates. The vulnerability arises because authenticated users with SQL View execution access can supply crafted filter values that are directly interpolated into generated SQL commands without proper neutralization. This allows manipulation of the SQL query logic and potential unauthorized data access beyond the intended SQL View result set. The vulnerability is distinct from CVE-2026-55084, which involves injection via filter column names. The issue was addressed by the 2026-06-09 EOS security updates, which introduced value-slot hardening to prevent such injection attacks. Later supported branches had this protection already in place via DHIS2-20174 / PR #22253.
Potential Impact
An authenticated user with SQL View execution privileges can exploit this vulnerability to manipulate SQL queries by injecting crafted filter values. This can lead to unauthorized access to data outside the intended SQL View result set, potentially exposing sensitive information. The vulnerability has a high CVSS 4.0 score of 8.7, indicating a significant risk if exploited.
Mitigation Recommendations
Apply the 2026-06-09 EOS security updates for DHIS2 versions 2.37, 2.38, and 2.39 to remediate this vulnerability. These updates include hardening of the value slots used in SQL View filters to prevent SQL injection. For later supported branches, the fix is already present. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-16T14:33:35.711Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5fc4922a4a8d5989a1c9ea
Added to database: 07/21/2026, 19:12:18 UTC
Last enriched: 07/30/2026, 08:53:58 UTC
Last updated: 09/04/2026, 22:52:13 UTC
Views: 50
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.