CVE-2026-25495
High
Description
Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the element-indexes/get-elements endpoint is vulnerable to SQL Injection via the criteria[orderBy] parameter (JSON body). The application fails to sanitize this input before using it in the database query. An attacker with Control Panel access can inject arbitrary SQL into the ORDER BY clause by omitting viewState[order] (or setting both to the same payload). This issue is patched in versions 4.16.18 and 5.8.22.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Craftcms Craft Cms
PublishedFeb 9, 2026
First seenFeb 9, 2026
Weakness typeCWE-89SQL injection
How to fix
Update
- craftcms craft_cms4.16.18, 5.8.22 or later
- craftcms/cms5.8.22, 4.16.18 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| craftcms craft_cms | 4.0.0 < v < 4.16.18, 5.0.0 < v < 5.8.22, 4.0.0, 5.0.0 | 4.16.18, 5.8.22 |
| craftcms/cmsPackagist | 5.0.0-RC1 ≤ v < 5.8.22, 4.0.0-RC1 ≤ v < 4.16.18 | 5.8.22, 4.16.18 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.