CVE-2026-123489 · Package
NO FIX YET · SEE WHAT TO DO
Craft CMS passes attacker-supplied criteria arrays into element query configuration, letting a template build SQL that reveals database contents one yes-or-no answer at a time. An authenticated control panel user can read data the Craft database account can see.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running Craft CMS 4.0.0 to before 4.18.9 or Craft CMS 5.0.0 to before 5.11.2 where users can log into the control panel. Exposure depends on who has control panel accounts; sites with no control panel users outside the trusted team are lower risk. Public-facing sites with no control panel login can skip it.
Not affected if managed-hosting-patched, no-control-panel-users
Who cares craft-cms, php, self-hosted
composer show craftcms/cms and compare it to the fixed ranges below.4.18.9 or later5.11.2 or laterCraft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext() and getPrev() methods pass arbitrary criteria arrays to Craft::configure() without removing SQL-bearing properties such as orderBy and where. Authenticated control panel users can supply a crafted elementIds value, rendered as a sandboxed template, to obtain a conditional SQL oracle under the Craft database account.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.