~ / search / GHSA-g7j6-fmwx-7vp8

GHSA-g7j6-fmwx-7vp8

CraftCMS's `ElementSearchController` Affected by Blind SQL Injection

Source: GitHub Advisory Database (reviewed) High CVE-2026-31858

Packages

EcosystemPackageAffectedFixed in
Packagist craftcms/cms >= 5.0.0-RC1, < 5.9.9 5.9.9

Details

As written in the advisory (Markdown source, shown as plain text).

The `ElementSearchController::actionSearch()` endpoint is missing the `unset()` protection that was added to ElementIndexesController in [GHSA-2453-mppf-46cj](https://github.com/craftcms/cms/security/advisories/GHSA-2453-mppf-46cj). The exact same SQL injection vulnerability (including `criteria[orderBy]`, the original advisory vector) works on this controller because the fix was never applied to it. Any authenticated control panel user (no admin required) can inject arbitrary SQL via `criteria[where]`, `criteria[orderBy]`, or other query properties, and extract the full database contents via boolean-based blind injection. Users should update to the patched 5.9.9 release to mitigate the issue.

References

External links from the advisory. They lead to third-party sites.