CVE-2026-31858
Description
Craft is a content management system (CMS). The ElementSearchController::actionSearch() endpoint is missing the unset() protection that was added to ElementIndexesController in CVE-2026-25495. The exact same SQL injection vulnerability (including criteria[orderBy], the original advisory vector) works on this controller because the fix was never applied to it. Any authenticated control panel user (no admin required) can inject arbitrary SQL via criteria[where], criteria[orderBy], or other query properties, and extract the full database contents via boolean-based blind injection. Users should update to the patched 5.9.9 release to mitigate the issue.
How to fix
- craftcms craft_cms5.9.9 or later
- craftcms/cms5.9.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| craftcms craft_cms | 5.0.1 ≤ v < 5.9.9, 5.0.0 | 5.9.9 |
| craftcms/cmsPackagist | 5.0.0-RC1 ≤ v < 5.9.9 | 5.9.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.