External risk intelligence

Craft CMS SQL Injection via Element Search Endpoint Affects All Versions

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-123488

Craft CMS is a content management system designed to power public-facing websites. The vulnerability exists in the element search endpoint, which is a core component typically exposed to the internet for front-end site functionality. Because this service is public-facing by design in standard deployments, it is highly likely to be reachable from the internet.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in Craft CMS affecting its element search functionality. The issue allows unauthenticated attackers to inject malicious SQL code, potentially leading to unauthorized access and modification of sensitive database information, including user credentials. The primary concern is confirming whether our systems utilize the affected versions of Craft CMS and assessing the potential exposure.

Unauthenticated attackers can alter database content.
This vulnerability allows control over administrative access.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit a vulnerability in Craft CMS's element search feature by sending specially crafted requests. This allows them to inject malicious SQL code, potentially leading to unauthorized access and control over the system.

No authentication required.
Triggered via element search endpoint.
Allows database compromise and admin takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow remote attackers to access and modify the Craft CMS database. Supported conditions for exposure include when the element search endpoint is reachable from the internet. Attackers could potentially gain administrator access by altering user credentials or setting administrative flags.

Database integrity and confidentiality.
Via unsanitized element search endpoint.
Unauthorized administrator access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The ownership of this vulnerability likely falls to the teams managing the Craft CMS application and its underlying infrastructure. The first step should be to identify all instances of the affected Craft CMS deployment, determine their reachability and criticality to business operations, and then confirm the accountable owner for each instance to plan remediation.

Application owners must own the issue.
Verify if the affected technology is exposed.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Craft CMS and what is it used for?

Craft CMS is a content management system (CMS) built on the PHP framework. It provides developers and content creators with a flexible platform to structure, manage, and display digital content on public-facing websites. Its architecture relies on various internal endpoints to handle site functionality, such as searching for elements or content, which allows the application to serve dynamic data to visitors.

What does CVE-2026-123488 mean as a SQL injection weakness?

This CVE describes an Improper Neutralization of Special Elements used in an SQL Command, known as CWE-89. It happens when the software takes user-provided data and inserts it directly into a database command without proper cleaning. In this specific case, the element search endpoint fails to sanitize inputs, allowing an attacker to manipulate the database query to execute unauthorized commands or access restricted data.

How is this SQL injection triggered in Craft CMS?

The vulnerability is triggered when an attacker sends a specially crafted request to the element search endpoint. Because the software improperly concatenates the attribute parameter into a database query and uses a database configuration that supports stacked statements, an attacker can append their own malicious SQL commands. Simply navigating or using the site normally does not trigger this; it requires an intentional, malicious payload sent to that specific endpoint.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal indicates this vulnerability is very likely to be reachable because the affected element search endpoint is a core feature often exposed to the internet for standard site functionality. If your Craft CMS instance is public-facing—which is typical for its role as a website management system—the endpoint is likely accessible to remote attackers, increasing the relevance of this issue.

What should I do if I run Craft CMS?

The priority is to identify all running instances of the affected versions, 4.x before 4.18.9 and 5.x before 5.11.2. Once identified, map these instances to the teams responsible for their infrastructure. Your focus should be on verifying the version in use and preparing to apply the necessary software updates provided by the vendor to remediate the endpoint's insecure query handling.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.