CVE-2026-55082
Deferred Deferred - Pending Action

SQL Injection in DHIS2 via Filter Values

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticated users with SQL View access to provide crafted filter values that were interpolated into generated SQL. An authenticated user with access to SQL View execution could manipulate SQL generated for SQL View filters and potentially access data outside the intended SQL View result set. This is distinct from CVE-2026-55084, which tracks the related SQL View filter column-name injection. Known affected release lines for this advisory: DHIS2 2.37, 2.38, and 2.39 before the 2026-06-09 EOS security updates. Patched by the 2026-06-09 EOS security updates for 2.37, 2.38, and 2.39. The same value-slot hardening was already present on later supported branches through DHIS2-20174 / PR #22253.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-22
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-55082
EUVD
EUVD-2026-46351

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
dhis2 dhis2 2.37
dhis2 dhis2 2.38
dhis2 dhis2 2.39
dhis2 dhis2 to 2.40 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55082 is a SQL injection vulnerability in DHIS2's SQL View functionality. Authenticated users with SQL View access could provide crafted filter values that were improperly interpolated into generated SQL queries. This allowed manipulation of SQL View filters, potentially exposing data outside the intended result set.

Detection Guidance

Detecting this vulnerability requires checking DHIS2 versions and SQL View configurations. Verify if your DHIS2 instance is running versions 2.37, 2.38, or 2.39 without the 2026-06-09 security updates. Inspect SQL View endpoints for unsanitized user input handling in filters or fields. Check logs for suspicious SQL errors or UNION SELECT patterns in requests to /api/sqlViews/data endpoints.

Impact Analysis

An attacker with SQL View access could execute arbitrary SQL commands through error-based exfiltration or UNION SELECT attacks. This may lead to unauthorized data access, modification, or deletion. The vulnerability requires authentication but could expose sensitive information beyond the intended SQL View results.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using affected DHIS2 versions may face compliance violations if exploited.

Mitigation Strategies
  • Upgrade DHIS2 to the patched EOS builds for versions 2.37, 2.38, or 2.39 released on 2026-06-09.
  • Apply parameter binding for filter values and identifier quoting for SQL View fields to prevent SQL injection.
  • Review and restrict access to SQL View functionality to only trusted authenticated users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55082. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart