SQL injection in Craft CMS - #VU159597
Published: November 6, 2026
Vulnerability identifier: #VU159597
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated control panel user to infer database information through blind SQL injection in Craft CMS.
The vulnerability exists due to insufficient validation of criteria passed to getNext() and getPrev() when rendering attacker-controlled relational conditions in the Twig sandbox. An authenticated control panel user can supply SQL expressions in query criteria and obtain a conditional oracle under the Craft database account, even with the sandbox enabled.
Affected software
Craft CMS
Remediation
Install security update from vendor's website.
Craft CMS - addressed in versions 4.18.9, 5.11.2