CVE-2026-55084

Name of the Vulnerable Software and Affected Versions DHIS2 version 2.37 DHIS2 version 2.38 DHIS2 version 2.39 DHIS2 versions 2.40.x through 2.40.11.0 DHIS2 versions 2.41.x through 2.41.8.1 DHIS2 versions 2.42.x through 2.42.5.0 DHIS2 version 2.43.0 DHIS2 2.44 development branch before PR #24162

Description An error-based SQL injection exists in the SqlView API endpoint. An authenticated user with access to a SqlView can inject arbitrary SQL queries through the filter parameter in the /api/sqlViews/{viewId}/data.json endpoint. By abusing an expression executed by PostgreSQL, the output is reflected in the application error message, allowing the attacker to extract arbitrary database content.

Recommendations Update version 2.37 to 2.37-EOS. Update version 2.38 to 2.38-EOS. Update version 2.39 to 2.39-EOS. Update versions 2.40.x to 2.40.11.1 or 2.40.12. Update versions 2.41.x to 2.41.8.2. Update versions 2.42.x to 2.42.5.1. Update version 2.43.0 to 2.43.0.1. Update 2.44 development branch to the version after PR #24162. As a temporary mitigation, restrict access to the filter parameter in the /api/sqlViews/{viewId}/data.json endpoint.