Read the docs
TI-2026-85950 Aliases CVE-2026-123488GHSA-qvg8-69ff-cf67

SQL injection in Craft CMS element search endpoint

Priority MEDIUM 41CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an SQL injection flaw (CWE-89) in its element search endpoint. The attribute parameter is concatenated into the query without sanitization, and emulated PDO prepares allow stacked statements. An unauthenticated remote attacker can read and write the database, set the admin flag or overwrite password hashes in the users table to gain administrator access.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.

Why it matters now

EPSS 0.00476 41st percentileScored 2026-11-07
Fix Fixed cms (craftcms): 4.18.9, 5.11.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Craft CMScms4.0.0 to before 4.18.94.18.9Patch availableCNA
Craft CMScms5.0.0 to before 5.11.25.11.2Patch availableCNA
  • cms VendorCraft CMS Affected 4.0.0 to before 4.18.9 Fixed in 4.18.9 Patch available CNA
  • cms VendorCraft CMS Affected 5.0.0 to before 5.11.2 Fixed in 5.11.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*——Craft CMS
  • cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:* Versions — — ·Craft CMS

Remediation

Craft CMS 4 is fixed in version 4.18.9 and Craft CMS 5 is fixed in version 5.11.2.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA cms (craftcms) Fixed in 4.18.9
  • Fix · CNA cms (craftcms) Fixed in 5.11.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    craftcms cms 5.11.2

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-85953 SQL injection in Craft CMS GraphQL lets attackers read databasePriority MEDIUM 44
    • TI-2026-85952 Privilege escalation in Craft CMS lets users make accounts adminsPriority LOW 37
    • TI-2026-85951 Blind SQL injection in Craft CMS getNext and getPrev criteriaPriority LOW 31
    Show all 4 records →
  • Release ·

    craftcms cms 4.18.9

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-85953 SQL injection in Craft CMS GraphQL lets attackers read databasePriority MEDIUM 44
    • TI-2026-85951 Blind SQL injection in Craft CMS getNext and getPrev criteriaPriority LOW 31
    Show all 3 records →

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-123488
  2. 2026-11-06 Alias added: GHSA-qvg8-69ff-cf67

References

Advisory 1

  • TI-2025-23503 Craft CMS Allows Remote Code Execution KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-37138 RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms KEVCVSS 4.0CRITICAL 9.3
  • TI-2025-16994 Potential RCE with a compromised security key in craft/cms KEVCVSS 3.1HIGH 8.1
  • TI-2025-24595 Craft CMS stores user-provided content in session files KEVCVSS 4.0MEDIUM 6.9
  • TI-2023-22284 Craft CMS Remote Code Execution vulnerability CVSS 3.1CRITICAL 10.0
  • TI-2024-25171 Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. CVSS 3.1CRITICAL 9.8
See all 203 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences