SQL injection in DHIS2 SqlView filter parameter (CVE-2026-55084)

A SQL injection vulnerability exists in the `filter` parameter of the DHIS2 `/api/sqlViews/{viewId}/data.json` API endpoint. An authenticated user with access to any SqlView can inject arbitrary SQL queries, with error output reflected in the application response, enabling error-based extraction of arbitrary database content. No administrative privileges are required to exploit this vulnerability. Affected versions: - 2.37 - 2.38 - 2.39 - 2.40.x before 2.40.11.1/2.40.12 - 2.41.x before 2.41.8.2 - 2.42.x before 2.42.5.1 - 2.43.0 before 2.43.0.1 - 2.44 development branch before PR #24162 We recommend updating to: 2.37-EOS (2026-06-09), 2.38-EOS (2026-06-09), 2.39-EOS (2026-06-09), 2.40.11.1, 2.40.12, 2.41.8.2, 2.42.5.1, 2.43.0.1, 2.44 development branch after PR #24162. CVSS 8.8 · our assessment: this_week Reference: https://github.com/dhis2/dhis2-core/security/advisories/GHSA-pwmg-mvjw-4m23 Details: https://vuln.today/cve/CVE-2026-55084