Vulnerabilities

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext() and…

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext() and getPrev() methods pass arbitrary criteria arrays to Craft::configure() without removing SQL-bearing properties such as orderBy and where. Authenticated control panel users can supply a crafted elementIds value, rendered as a sandboxed template, to obtain a conditional SQL oracle under the Craft database account.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Craftcms

Product

cms

CVSS v3.1

7.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness

CWE-89

Exposure class

Web platform

NVD status

Received

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-123489 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 38
   CVE NVD 3h ago

   Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because…

   CVSS 9.8 CVE-2026-123488 Craftcms