Craft CMS (5.0.0 Through 5.11.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/craft-cms-5.0.0-through-5.11.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 06 Nov 2026 17:23:34 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCraft CMS: Unauthenticated SQL injection (CVE-2026-123488)https://feed.craftedsignal.io/briefs/2026-11-craft-cms-sqli/Fri, 06 Nov 2026 17:23:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-craft-cms-sqli/Craft CMS versions 4.0.0 through 4.18.8 and 5.0.0 through 5.11.1 contain an unauthenticated SQL injection vulnerability via the element search endpoint that enables remote attackers to perform unauthorized database operations and escalate privileges.Craft CMS versions 4.0.0 through 4.18.8 and 5.0.0 through 5.11.1 are vulnerable to an unauthenticated SQL injection flaw in the element search endpoint. The vulnerability exists due to improper sanitization of the 'attribute' parameter in combination with emulated PDO prepares, which permits stacked SQL queries.

Impact

An attacker can perform unauthorized read and write operations on the database. This allows for full database compromise, including the ability to overwrite user password hashes or modify administrative flags within the users table to gain persistent administrator access.

Recommendation

  • Upgrade Craft CMS 4.x installations to version 4.18.9 or later.
  • Upgrade Craft CMS 5.x installations to version 5.11.2 or later.
  • Review web server access logs for anomalous requests to the element search endpoint containing non-standard characters typically used for SQL injection, such as semicolons, comment markers, or SQL keywords in the 'attribute' query parameter.
]]>criticaladvisoryweb-applicationsql-injectioncve-2026-123488