CVE-2026-123489: Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria
Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext() and getPrev() methods pass arbitrary criteria arrays to Craft::configure() without removing SQL-bearing properties such as orderBy and where. Authenticated control panel users can supply a crafted elementIds value, rendered as a sandboxed template, to obtain a conditional SQL oracle under the Craft database account.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 4.18.9 - Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.11.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated Craft control panel account and the ability to supply a crafted elementIds value that is rendered as a sandboxed template. The resulting SQL injection is blind and operates using the Craft database account.
Which releases need to be updated?
Craft CMS 4.0.0 through versions before 4.18.9 are affected, as are Craft CMS 5.0.0 through versions before 5.11.2. Updating to 4.18.9 or 5.11.2, respectively, addresses the affected ranges.
How can administrators assess exposure?
Check whether the installation is in an affected version range and whether authenticated control panel users can provide elementIds input that reaches sandboxed template rendering. Accounts with control panel access are the relevant threat boundary described for exploitation.