CVE-2026-55084 in DHIS2
Summary
by MITRE • 07/21/2026
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the `filter` parameter used by the `/api/sqlViews/{viewId}/data.json` endpoint. An authenticated user with access to a SqlView can inject arbitrary SQL queries inside the `filter` parameter by abusing an expression executed by PostgreSQL and its output is reflected inside the application error message. This behavior enables attackers to extract arbitrary database content using error-based SQL injection.
Affected versions include: 2.37, 2.38, 2.39, 2.40.x before 2.40.11.1/2.40.12, 2.41.x before 2.41.8.2, 2.42.x before 2.42.5.1, 2.43.0 before 2.43.0.1, 2.44 development branch before PR #24162 Patched versions include: 2.37-EOS (2026-06-09), 2.38-EOS (2026-06-09), 2.39-EOS (2026-06-09), 2.40.11.1, 2.40.12, 2.41.8.2, 2.42.5.1, 2.43.0.1, 2.44 development branch after PR #24162
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/21/2026
The DHIS2 platform represents a critical infrastructure component for health information systems globally, processing sensitive patient and population health data across numerous healthcare organizations. This SQL injection vulnerability specifically targets the SqlView API endpoint within the application's data access layer, creating a significant security risk for organizations relying on the system for critical health data management. The vulnerability exists in the `/api/sqlViews/{viewId}/data.json` endpoint where user-supplied input is improperly sanitized before being incorporated into database queries. The `filter` parameter serves as the attack vector, allowing authenticated users with SqlView access privileges to inject malicious SQL constructs that bypass normal input validation mechanisms.
The technical exploitation of this vulnerability leverages PostgreSQL's error handling mechanisms to extract database information through error-based SQL injection techniques. When an attacker submits crafted SQL content within the filter parameter, the application processes this input without proper sanitization and executes it against the underlying PostgreSQL database. The resulting database errors contain the injected SQL output, which the application then reflects back to the user interface, creating a direct information disclosure channel. This error-based approach eliminates the need for out-of-band data exfiltration methods and provides attackers with immediate feedback during exploitation attempts. The vulnerability operates at the application layer, classified as CWE-89 SQL Injection, and represents a classic case of improper input validation combined with insecure error handling practices.
The operational impact of this vulnerability extends beyond simple data theft, potentially enabling attackers to escalate privileges and access additional system resources within the DHIS2 environment. An authenticated attacker can leverage this vulnerability to extract sensitive health information, user credentials, system configurations, and other confidential data stored within the PostgreSQL database. The affected versions span multiple major releases, indicating a prolonged period during which organizations remained vulnerable to this specific attack pattern. The vulnerability affects organizations that implement SqlView functionality for custom data queries, potentially compromising thousands of healthcare facilities worldwide that rely on DHIS2 for their health information systems. This presents significant risk to patient privacy and healthcare data security, particularly in regions where DHIS2 serves as the primary platform for health information management.
Security mitigation strategies should prioritize immediate patch deployment across all affected versions, with particular attention to the end-of-life support status of older releases including 2.37 through 2.39 which have reached their designated support expiration dates. Organizations should implement network-level restrictions limiting access to SqlView endpoints to authorized personnel only, while also establishing monitoring for unusual API request patterns that may indicate exploitation attempts. The vulnerability demonstrates the importance of proper input validation and error handling in web applications, aligning with ATT&CK technique T1213 Data from Information Repositories which focuses on accessing data repositories through application interfaces. Additional defensive measures should include enabling database query logging to detect malicious SQL injection attempts, implementing web application firewalls to filter suspicious requests, and conducting regular security assessments of API endpoints to identify similar vulnerabilities in other system components.
Organizations using DHIS2 should also consider implementing additional access controls beyond basic authentication, including role-based access controls specifically limiting SqlView creation and modification permissions to trusted administrators only. The patch versions provided address the root cause by implementing proper parameter sanitization and input validation mechanisms that prevent malicious SQL from being executed within the database context. Security teams should perform comprehensive testing of patched environments to ensure that legitimate functionality remains intact while vulnerability remediation is properly implemented. The vulnerability landscape for health information systems continues to evolve, making it essential for healthcare organizations to maintain robust security postures and stay current with vendor security advisories and patches.