{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "lang": "en-US",
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "title": "DHIS2 SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read",
    "tracking": {
      "current_release_date": "2026-07-23T18:24:12Z",
      "generator": {
        "engine": {
          "name": "VINCE-NT",
          "version": "1.15.0+build.101"
        }
      },
      "id": "VA-26-204-02",
      "initial_release_date": "2026-07-23T18:24:12Z",
      "status": "final",
      "version": "1.0.0",
      "revision_history": [
        {
          "number": "1.0.0",
          "summary": "Initial publication",
          "date": "2026-07-23T18:24:12Z"
        }
      ]
    },
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
        "title": "Legal Notice",
        "category": "legal_disclaimer"
      },
      {
        "text": "Worldwide",
        "title": "Countries and Areas Deployed",
        "category": "other"
      },
      {
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors",
        "category": "other"
      },
      {
        "text": "A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the `filter` parameter used by the `/api/sqlViews/{viewId}/data.json` endpoint. An authenticated user with access to a SqlView can inject arbitrary SQL queries inside the `filter` parameter by abusing an expression executed by PostgreSQL and its output is reflected inside the application error message. This behavior enables attackers to extract arbitrary database content using error-based SQL injection.",
        "title": "Risk Evaluation",
        "category": "summary"
      },
      {
        "text": "Fixed in PR #24162. Update to one of the fixed versions.",
        "title": "Recommended Practices",
        "category": "general"
      },
      {
        "text": "Norway",
        "title": "Company Headquarters Location",
        "category": "other"
      }
    ],
    "references": [
      {
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-204-02.json",
        "summary": "Vulnerability Advisory VA-26-204-02 CSAF",
        "category": "self"
      }
    ]
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "dhis2",
        "branches": [
          {
            "category": "product_name",
            "name": "dhis2-core",
            "branches": [
              {
                "category": "product_version_range",
                "name": ">=2.37|<=2.39",
                "product": {
                  "name": "dhis2 dhis2-core >=2.37|<=2.39",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version_range",
                "name": ">=2.40.0|<2.40.11.1",
                "product": {
                  "name": "dhis2 dhis2-core >=2.40.0|<2.40.11.1",
                  "product_id": "CSAFPID-0002"
                }
              },
              {
                "category": "product_version_range",
                "name": ">=2.41.0|<2.41.8.2",
                "product": {
                  "name": "dhis2 dhis2-core >=2.41.0|<2.41.8.2",
                  "product_id": "CSAFPID-0003"
                }
              },
              {
                "category": "product_version_range",
                "name": ">=2.42.0|<2.42.5.1",
                "product": {
                  "name": "dhis2 dhis2-core >=2.42.0|<2.42.5.1",
                  "product_id": "CSAFPID-0004"
                }
              },
              {
                "category": "product_version_range",
                "name": ">=2.43.0|<2.43.0.1",
                "product": {
                  "name": "dhis2 dhis2-core >=2.43.0|<2.43.0.1",
                  "product_id": "CSAFPID-0005"
                }
              },
              {
                "category": "product_version",
                "name": "2.37-EOS (2026-06-09)",
                "product": {
                  "name": "dhis2 dhis2-core 2.37-EOS (2026-06-09)",
                  "product_id": "CSAFPID-0006"
                }
              },
              {
                "category": "product_version",
                "name": "2.38-EOS (2026-06-09)",
                "product": {
                  "name": "dhis2 dhis2-core 2.38-EOS (2026-06-09)",
                  "product_id": "CSAFPID-0007"
                }
              },
              {
                "category": "product_version",
                "name": "2.39-EOS (2026-06-09)",
                "product": {
                  "name": "dhis2 dhis2-core 2.39-EOS (2026-06-09)",
                  "product_id": "CSAFPID-0008"
                }
              },
              {
                "category": "product_version",
                "name": "2.40.11.1",
                "product": {
                  "name": "dhis2 dhis2-core 2.40.11.1",
                  "product_id": "CSAFPID-0009"
                }
              },
              {
                "category": "product_version",
                "name": "2.40.12",
                "product": {
                  "name": "dhis2 dhis2-core 2.40.12",
                  "product_id": "CSAFPID-0010"
                }
              },
              {
                "category": "product_version",
                "name": "2.41.8.2",
                "product": {
                  "name": "dhis2 dhis2-core 2.41.8.2",
                  "product_id": "CSAFPID-0011"
                }
              },
              {
                "category": "product_version",
                "name": "2.42.5.1",
                "product": {
                  "name": "dhis2 dhis2-core 2.42.5.1",
                  "product_id": "CSAFPID-0012"
                }
              },
              {
                "category": "product_version",
                "name": "2.43.0.1",
                "product": {
                  "name": "dhis2 dhis2-core 2.43.0.1",
                  "product_id": "CSAFPID-0013"
                }
              },
              {
                "category": "product_version",
                "name": "2.44",
                "product": {
                  "name": "dhis2 dhis2-core 2.44",
                  "product_id": "CSAFPID-0014"
                }
              }
            ]
          }
        ]
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-55084",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
      },
      "notes": [
        {
          "category": "summary",
          "text": "DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the `filter` parameter used by the\n`/api/sqlViews/{viewId}/data.json` endpoint. An authenticated user with access to a SqlView can inject arbitrary SQL queries inside the `filter` parameter by abusing an expression executed by PostgreSQL and its output is reflected inside the application error message. This behavior enables attackers to extract arbitrary database content using error-based SQL injection. Fixed in PR #24162.",
          "title": "Description"
        },
        {
          "category": "details",
          "title": "SSVC",
          "text": "SSVCv2/E:N/A:N/T:T/2026-07-22T15:52:51Z/"
        }
      ],
      "title": "SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read",
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005"
        ],
        "fixed": [
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0014"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/dhis2/dhis2-core/security/advisories/GHSA-pwmg-mvjw-4m23"
        },
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/dhis2/dhis2-core/pull/24162"
        },
        {
          "category": "external",
          "summary": "CVE-2026-55084",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55084"
        },
        {
          "category": "external",
          "summary": "VA-26-204-02 CSAF",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-204-02.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ]
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in 2.37-EOS (2026-06-09).",
          "url": "https://github.com/dhis2/dhis2-core/pull/24162",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "date": "2026-06-09T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 2.38-EOS (2026-06-09).",
          "url": "https://github.com/dhis2/dhis2-core/pull/24162",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "date": "2026-06-09T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 2.39-EOS (2026-06-09).",
          "url": "https://github.com/dhis2/dhis2-core/pull/24162",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "date": "2026-06-09T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 2.40.11.1.",
          "url": "https://github.com/dhis2/dhis2-core/pull/24162",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "date": "2026-06-09T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 2.40.12.",
          "url": "https://github.com/dhis2/dhis2-core/pull/24162",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "date": "2026-06-09T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 2.41.8.2.",
          "url": "https://github.com/dhis2/dhis2-core/pull/24162",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "date": "2026-06-09T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 2.42.5.1.",
          "url": "https://github.com/dhis2/dhis2-core/pull/24162",
          "product_ids": [
            "CSAFPID-0012"
          ],
          "date": "2026-06-09T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 2.43.0.1.",
          "url": "https://github.com/dhis2/dhis2-core/pull/24162",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "date": "2026-06-09T00:00:00Z"
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in 2.44.",
          "url": "https://github.com/dhis2/dhis2-core/pull/24162",
          "product_ids": [
            "CSAFPID-0014"
          ],
          "date": "2026-06-09T00:00:00Z"
        }
      ],
      "acknowledgments": [
        {
          "names": [
            "Ahmed Najeh"
          ]
        }
      ],
      "release_date": "2026-07-21T00:00:00Z"
    }
  ]
}