SQL injection in Craft CMS - #VU159606
Published: November 6, 2026
Vulnerability identifier: #VU159606
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker with no additional permissions to read sensitive database contents in Craft CMS.
The vulnerability exists due to address controllers passing unsanitized nested request arrays into Element::findOne() as query criteria, enabling SQL injection. An authenticated attacker with no additional permissions can submit crafted address requests to extract data through blind SQL injection before ownership checks, with at least one address row required for reliable time-based extraction.
Affected software
Craft CMS
Remediation
Install security update from vendor's website.
Craft CMS - update to 5.11.5