SQL injection in Craft CMS - #VU159595
Published: November 6, 2026
Vulnerability identifier: #VU159595
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated attacker to read arbitrary Craft CMS database data, including password hashes and session tokens.
The vulnerability exists due to unsanitized GraphQL eager-load criteria allowing a crafted select argument to inject SQL expressions. An unauthenticated attacker can exploit a public schema permitting anonymous section or asset-volume reads but no user-group reads by querying an authored entry or an asset with a populated uploader to retrieve data beyond the schema’s scope.
Affected software
Craft CMS
Remediation
Install security update from vendor's website.
Craft CMS - addressed in versions 4.18.9, 5.11.2