Vulnerability · Published Feb 9, 2026 · Assigned by GitHub_M

CVE-2026-25495Craft has a SQL Injection in Element Indexes via criteria[orderBy]

High 8.7

In plain English

A high-severity SQL injection in cms from craftcms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.6%top 53.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the element-indexes/get-elements endpoint is vulnerable to SQL Injection via the criteria[orderBy] parameter (JSON body). The application fails to sanitize this input before using it in the database query. An attacker with Control Panel access can inject arbitrary SQL into the ORDER BY clause by omitting viewState[order] (or setting both to the same payload). This issue is patched in versions 4.16.18 and 5.8.22.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	craftcms/cms	5.8.22	GHSA-2453-mppf-46cj
Packagist	craftcms/cms	4.16.18	GHSA-2453-mppf-46cj

Affected products (as reported)

Vendor	Product	Versions
craftcms	cms	>= 5.0.0-RC1, < 5.8.22>= 4.0.0-RC1, < 4.16.18

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/craftcms/cms/security/advisories/GHSA-2453-mppf-46cj x_refsource_CONFIRM
https://github.com/craftcms/cms/commit/96c60d775c644ff0a0276da52fe29e11d4cd38d2 x_refsource_MISC
https://github.com/craftcms/cms/releases/tag/5.8.22 x_refsource_MISC