CVE-2026-115934

9.8 CRITICALpublic exploit available

Published 2026-11-09 · Updated 2026-11-10

AI risk analysis

Summary: An unauthenticated SQL injection vulnerability exists in Craft CMS's front-end search functionality due to unsanitized use of the 'attribute' parameter with PDO emulated prepares enabled, allowing stacked queries and full database compromise including privilege escalation to admin.
Exploitability: Exploitation is trivial for unauthenticated attackers on MySQL/MariaDB systems where the vulnerable craft.search endpoint is exposed, requiring only a single HTTP request with crafted query parameters.
Blast radius: Any Craft CMS site using MySQL/MariaDB and exposing front-end search via craft.search is at critical risk of full database exfiltration, data manipulation, and unauthorized admin account takeover without authentication.
Detection: Defenders should monitor web server access logs for HTTP GET/POST requests to /index.php with 'attribute=' or '%5Battribute%5D' in the query string, especially when followed by SQL keywords (e.g., SELECT, UNION, INSERT) or stacked statement syntax (semicolon-prefixed queries); such patterns may indicate exploitation attempts.
Prioritized remediation: Upgrade to Craft CMS versions 4.18.9 or 5.11.2 immediately; as an interim measure, block HTTP requests containing '%5Battribute%5D' or '[attribute]' in the query string.

sql-injectionstacked-queriesprivilege-escalationwebcraft-cmsmysql

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

An unauthenticated SQL injection can occur on the front end of any site that uses craft.search to perform a search, allowing stacked query execution and enabling escalation to an administrator. Note that this only affects MySQL/MariaDB. Impact * SQL injection — The attribute parameter is concatenated into the query unsanitized, and because PDO runs with emulated prepares, stacked statements execute. This gives unauthenticated read and write access to the application database. * Privilege escalation to administrator — The write primitive was used to set the admin flag on user ID 1 in the users table, confirmed by reading the value back. Craft short-circuits its permission checks on this single column, so no further changes were needed. The same primitive can overwrite any account’s password hash. Update to the patched versions (4.18.9 and 5.11.2) to get the fix. If you cannot update immediately, you can block front-end requests with %5Battribute%5D and [attribute] anywhere in the query string as a temporary mitigation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.