Element: SQL injection

craftcms cms

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements.

Do this now

Check Craft CMS's advisory for a fix and restrict access to the element search endpoint.

First seen: 6 Nov 2026
Last update: 6 Nov 2026, 21:17 UTC
Versions per the CVE record from VulnCheck, not the vendor: 5.11.2
4.18.9
Identifiers: CVE-2026-123488
CVSS: 9.8
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Element: SQL injection
Severity: critical. Patch status: fix status unknown.
Affected: craftcms cms
Versions per the CVE record from VulnCheck, not the vendor: 5.11.2, 4.18.9
Ids: CVE-2026-123488

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements.

## Steps
1. Search the repo, its CI and infra config for craftcms cms. If present, report the version in use and whether it's affected.
2. Versions per the CVE record from VulnCheck, not the vendor: craftcms cms: 5.0.x → 5.11.2; 4.0.x → 4.18.9. Don't treat them as a fix until the vendor says so.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| craftcms cms 5.0.x | per the CVE record from VulnCheck, not the vendor | 5.11.2 | restrict network access to it |
| craftcms cms 4.0.x | per the CVE record from VulnCheck, not the vendor | 4.18.9 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-123488") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/craftcms/cms/security/advisories/GHSA-qcvp-ggx3-97r6 https://nvd.nist.gov/vuln/detail/CVE-2026-123488
https://pwned.coffee/i/element-sql-injection-cve-2026-123488

Receipt

Exploitation: No known exploitation
By release line, per the CVE record from VulnCheck, not the vendor: Product Affected Version named Source
craftcms cms 5.0.0 to before 5.11.2 5.11.2 CVE record (CNA) per the CVE record from VulnCheck, not the vendor checked 6 Nov
craftcms cms 4.0.0 to before 4.18.9 4.18.9 CVE record (CNA) per the CVE record from VulnCheck, not the vendor checked 6 Nov
Score: CVSS 9.8 (critical). CVSS 3.1 9.8 (CNA VulnCheck) for CVE-2026-123488
Last checked: 7 Nov 2026, 18:18 UTC

Product	Affected	Version named	Source
craftcms cms	5.0.0 to before 5.11.2	5.11.2	CVE record (CNA) per the CVE record from VulnCheck, not the vendor checked 6 Nov
craftcms cms	4.0.0 to before 4.18.9	4.18.9	CVE record (CNA) per the CVE record from VulnCheck, not the vendor checked 6 Nov

Sources: KEV – CVE record ✓ Vendor –

Sources

Follow on X

Totalone very hot coffee