PT-2026-7145 · Craft · Craft

Mhe4Am · Published 2026-02-09 · Updated 2026-02-11 · CVE-2026-25495

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Craft versions 4.0.0-RC1 through 4.16.17 Craft versions 5.0.0-RC1 through 5.8.21

Description Craft is a platform for creating digital experiences. The element-indexes/get-elements API endpoint is susceptible to SQL Injection via the criteria[orderBy] parameter within the JSON body. The application does not properly sanitize input received through this parameter before utilizing it in database queries. An authenticated attacker with Control Panel access can inject arbitrary SQL into the ORDER BY clause by omitting viewState[order] or setting both to the same payload.

Recommendations Update to Craft version 4.16.18 or later. Update to Craft version 5.8.22 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-25495

GHSA-2453-MPPF-46CJ

Affected Products

Craft

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25495.json · Exploit
• https://github.com/craftcms/cms/security/advisories/GHSA-2453-mppf-46cj · Patch
• https://github.com/craftcms/cms/commit/96c60d775c644ff0a0276da52fe29e11d4cd38d2 · Patch
• https://osv.dev/vulnerability/CVE-2026-25495 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25495 · Security Note
• https://osv.dev/vulnerability/GHSA-2453-mppf-46cj · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/releases/tag/5.8.22 · Note
• https://github.com/craftcms/cms/releases/tag/4.16.18 · Note
• https://twitter.com/VulmonFeeds/status/2020978785852477619 · Twitter Post
• https://twitter.com/_cvereports/status/2021006219285008880 · Twitter Post
• https://twitter.com/CVEnew/status/2020959690088214650 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1r1vyjc/resumen_diario_de_vulnerabilidades_11022026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1r1w0bk/resumen_diario_de_vulnerabilidades_11022026 · Reddit Post