CVE-2026-25495

Katalog CVE

CVSS 8.8 · High EPSS 0,61%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada craftcms craft cms. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the element-indexes/get-elements endpoint is vulnerable to SQL Injection via the criteria[orderBy] parameter (JSON body). The application fails to sanitize this input before using it in the database query. An attacker with Control Panel access can inject arbitrary SQL into the ORDER BY clause by omitting viewState[order] (or setting both to the same payload). This issue is patched in versions 4.16.18 and 5.8.22.

Rincian

Terbit di NVD

9 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/craftcms/cms/security/advisories/GHSA-2453-mppf-46cj exploit · patch · advisory vendor
• https://github.com/craftcms/cms/commit/96c60d775c644ff0a0276da52fe29e11d4cd38d2 patch
• https://github.com/craftcms/cms/releases/tag/5.8.22 release notes