CVE-2026-123489

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext and getPrev methods pass arbitrary criteria arrays to Craft::configure without removing SQL-bearing properties such as orderBy and where. Authenticated control...

CVE-2026-123489 Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext and getPrev methods pass arbitrary criteria arrays to Craft::configure without removing SQL-bearing properties such as orderBy and where. Authenticated control...

CVE-2026-123489

Craft CMS versions 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 are vulnerable to a blind SQL injection vulnerability. The root cause is that the sandbox-exposed getNext() and getPrev() methods pass arbitrary criteria arrays to Craft::configure() without stripping SQL-bearing properties like order...

EUVD-2026-118289

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext and getPrev methods pass arbitrary criteria arrays to Craft::configure without removing SQL-bearing properties such as orderBy and where. Authenticated control...

CVE-2026-123489: craftcms cms: Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the…

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext and getPrev methods pass arbitrary criteria arrays to Craft::configure without removing SQL-bearing properties such as orderBy and where. Authenticated control...

CVE-2026-112773

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event...

CVE-2026-112773 Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event...

CVE-2026-112773

Craft CMS versions 5.0.0 before 5.11.0 are vulnerable to a remote code execution (RCE) vulnerability. The flaw allows authenticated Control Panel users to escape the Twig sandbox by providing uncleansed criteria to the getNext, getPrev, or getOwners functions. By injecting Yii "as" or "on" config...

EUVD-2026-104579

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event...

CVE-2026-112773 Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event...

CVE-2026-112773 Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event...

CVE-2026-112773: Improper Control of Generation of Code

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event...

PT-2026-117624

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event...

Craft CMS code injection vulnerability

A code injection vulnerability exists in Craft CMS versions 5.0.0 through 5.11.0. This vulnerability stems from a Twig sandbox escape, Authenticated control panel users can pass unsanitized conditions to getNext, getPrev, or getOwners and inject malicious event handlers attached to Yii’s “as” or...