CVE-2026-115934: SQL injection leading to privilege escalation
An unauthenticated SQL injection can occur on the front end of any site that uses craft.search to perform a search, allowing stacked query execution and enabling escalation to an administrator.
Note that this only affects MySQL/MariaDB.
Impact SQL injection — The attribute parameter is concatenated into the query unsanitized, and because PDO runs with emulated prepares, stacked statements execute. This gives unauthenticated read and write access to the application database. Privilege escalation to administrator — The write primitive was used to set the admin flag on user ID 1 in the users table, confirmed by reading the value back. Craft short-circuits its permission checks on this single column, so no further changes were needed. The same primitive can overwrite any account’s password hash.
Update to the patched versions (4.18.9 and 5.11.2) to get the fix.
If you cannot update immediately, you can block front-end requests with %5Battribute%5D and [attribute] anywhere in the query string as a temporary mitigation.
Other sources
An unauthenticated SQL injection in the element search endpoint allows stacked query execution, enabling escalation to an administrator.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craftto a version that resolves this vulnerability.Fixed in 4.18.9 - Upgrade
Upgrade
Craftto a version that resolves this vulnerability.Fixed in 5.11.2 - Compensating control
As a temporary mitigation, block front-end requests containing %5Battribute%5D or [attribute] anywhere in the query string.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
No authentication or prior privileges are required. The vulnerable element search endpoint can be reached remotely, and the issue has low attack complexity with no user interaction required.
What can a successful attacker achieve?
The SQL injection permits stacked query execution and can be used to escalate privileges to an administrator. The reported impact includes full compromise of confidentiality, integrity, and availability.