DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code execution (RCE) via unsafe Java deserialization. This issue has been patched in versions 2.42.5.1, 2.43.0.1, and 2.44.
DHIS2-core versions 2.37, 2.38, and 2.39 prior to the 2026-06-09 EOS security updates contain an SQL injection vulnerability in the SQL View data endpoints. Authenticated users with SQL View access could craft filter values that are improperly neutralized and interpolated into SQL queries, potentially allowing access to data outside the intended result set. This vulnerability is distinct from a related injection issue tracked as CVE-2026-55084. The issue was patched in the 2026-06-09 EOS security updates for the affected versions, and later supported branches had this hardening already applied.
A cross-site scripting (XSS) vulnerability exists in the DHIS2 OpenAPI HTML endpoint where the 'scope' query parameter is reflected into the HTML output without proper sanitization. This allows an attacker to craft a URL that executes arbitrary JavaScript in the context of the DHIS2 web application. The issue affects DHIS2 versions 2.42, 2.43, and 2.44 before the June 9, 2026 security patches. Fixed versions include 2.42.5.1, 2.43.0.1, and the updated 2.44 development branch.
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the `filter` parameter used by the
`/api/sqlViews/{viewId}/data.json` endpoint. An authenticated user with access to a SqlView can inject arbitrary SQL queries inside the `filter` parameter by abusing an expression executed by PostgreSQL and its output is reflected inside the application error message. This behavior enables attackers to extract arbitrary database content using error-based SQL injection.
Affected versions include: 2.37, 2.38, 2.39, 2.40.x before 2.40.11.1/2.40.12, 2.41.x before 2.41.8.2, 2.42.x before 2.42.5.1, 2.43.0 before 2.43.0.1, 2.44 development branch before PR #24162
Patched versions include: 2.37-EOS (2026-06-09), 2.38-EOS (2026-06-09), 2.39-EOS (2026-06-09), 2.40.11.1, 2.40.12, 2.41.8.2, 2.42.5.1, 2.43.0.1, 2.44 development branch after PR #24162