Description (CNA)
Craft is a content management system (CMS). The ElementSearchController::actionSearch() endpoint is missing the unset() protection that was added to ElementIndexesController in CVE-2026-25495. The exact same SQL injection vulnerability (including criteria[orderBy], the original advisory vector) works on this controller because the fix was never applied to it. Any authenticated control panel user (no admin required) can inject arbitrary SQL via criteria[where], criteria[orderBy], or other query properties, and extract the full database contents via boolean-based blind injection. Users should update to the patched 5.9.9 release to mitigate the issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| craftcms / cms | affected >= 5.0.0-RC1, <= 5.9.8 |
CWE
CWE-89
References
- https://github.com/craftcms/cms/security/advisories/GHSA-g7j6-fmwx-7vp8
- https://github.com/craftcms/cms/commit/e1a3dd669ae31491b86ad996e88a1d30d33d9a42
ADP enrichment
No English description supplied.
No references supplied.