CVE-2026-110911
Deferred Deferred - Pending Action

SQL Injection in Wheels Framework

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: MITRE

Description
Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup paths (findByKey, updateByKey, deleteByKey and findOrCreateBy...), and validatesUniquenessOf. The parser incorrectly treats a doubled single quote as the end of a literal. Applications passing request data to these APIs can expose authentication, password-reset or token lookups, and data to unauthorized access; numeric-column values are not affected. There is a similar concern for query-builder whereBetween() in 4.0.0 through 4.1.1: string/date bounds can alter SQL on MySQL/MariaDB with backslash escaping enabled. This is fixed in 4.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-110911
EUVD
EUVD-2026-101818

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Wheels Wheels 1.1.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in the Wheels framework versions 1.1.8 through 4.1.1. It occurs when user-supplied values containing quotes are improperly handled in dynamic finders, query builder methods, and key-based lookups. Attackers can manipulate SQL queries by including quotes in inputs like email addresses, bypassing authentication and accessing sensitive data.

Detection Guidance

To detect this vulnerability, inspect your Wheels framework version. If using versions 1.1.8 through 4.1.1, the system is vulnerable. Check application logs for unusual SQL query patterns or errors indicating quote-based injection attempts. Review dynamic finder methods, query builder calls, and key-based lookups for improper input handling.

Impact Analysis

Attackers could bypass authentication systems, reset passwords, steal tokens, or access unauthorized data. They might enumerate database rows, read sensitive information, or alter data. The impact includes high risk to confidentiality, integrity, and availability of the application and its data.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance violations, legal penalties, and reputational damage due to data breaches resulting from this SQL injection flaw.

Mitigation Strategies

Upgrade Wheels to version 4.1.2 or later immediately. If upgrading is not possible, validate and sanitize all user-supplied inputs, especially those passed to dynamic finders, query builders, or key-based methods. Avoid using string/UUID primary keys for sensitive operations. Consider using numeric primary keys as a workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110911. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart