SQL Injection in Craftcms Cms
CVE-2026-123489
Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext() and getPrev() methods pass arbitrary criteria arrays to Craft::configure() without removing SQL-bearing properties such as orderBy and where. Authenticated control panel users can supply a crafted elementIds value, rendered as a sandboxed template, to obtain a conditional SQL oracle under the Craft database account.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N.
EPSS exploit prediction
EPSS: 0.002 (15.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 15th percentile — 15.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
The 30-day trend appears once there are two daily scores.
Affected products
Weakness classification (CWE)
References
- github.com/craftcms/cms/security/advisories/GHSA-f6gf-r952-rxg6 (vendor-advisory)
- www.vulncheck.com/advisories/craft-cms-4.0.0-before-4.18.9-blind-sql-injection-… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-123489?
- CVE-2026-123489 is a high-severity vulnerability in Craftcms Cms, classified under SQL Injection. CVSS score: 7.1/10. Published 2026-11-06.
- How severe is CVE-2026-123489?
- High severity. CVSS v3 base score is 7.1 out of 10.