Executive Summary

CVE-2026-31858 is a high-severity SQL injection vulnerability in the Craft CMS, specifically in the ElementSearchController::actionSearch() endpoint.

The vulnerability exists because this endpoint lacks the unset() protection that was added to a similar controller in a previous advisory, allowing attackers to inject arbitrary SQL commands.

Any authenticated control panel user, without needing admin privileges, can exploit this by injecting SQL through parameters like criteria[where], criteria[orderBy], or other query properties.

This injection enables boolean-based blind SQL injection attacks, allowing extraction of the full database contents.

The issue was fixed by sanitizing the query criteria inputs using a cleansing function to remove unsafe attributes, and the fix was released in version 5.9.9.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows any authenticated control panel user to perform SQL injection attacks, which can lead to unauthorized access to the entire database.

Attackers can extract sensitive data by exploiting boolean-based blind SQL injection, potentially compromising confidential information stored in the CMS.

Since no admin privileges are required, the attack surface is broader, increasing the risk of data breaches and manipulation.

To mitigate this risk, users should update to Craft CMS version 5.9.9 or later, where the vulnerability has been patched.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability is a blind SQL injection in the ElementSearchController::actionSearch() endpoint of Craft CMS, exploitable by any authenticated control panel user via parameters such as criteria[where] and criteria[orderBy].'}, {'type': 'paragraph', 'content': 'To detect this vulnerability on your system, you can attempt to test the affected endpoint by sending crafted HTTP requests to the actionSearch() endpoint with SQL injection payloads in the criteria parameters and observe if boolean-based blind SQL injection responses occur.'}, {'type': 'paragraph', 'content': 'Example commands using curl to test for SQL injection might include:'}, {'type': 'list_item', 'content': "curl -X POST -d 'criteria[where]=1=1--' https://your-craftcms-site.com/actions/element-search/search"}, {'type': 'list_item', 'content': "curl -X POST -d 'criteria[orderBy]=id; DROP TABLE users;--' https://your-craftcms-site.com/actions/element-search/search"}, {'type': 'paragraph', 'content': 'Note that these commands should be used carefully in a controlled environment and only on systems you have permission to test. Monitoring logs for unusual query parameters or unexpected database errors related to these criteria parameters can also help detect exploitation attempts.'}] [1, 2]

Useful 0 Not Useful 0

Mitigation Strategies

The primary and immediate mitigation step is to update Craft CMS to version 5.9.9 or later, where the vulnerability has been fixed by sanitizing the query criteria inputs in the ElementSearchController.

Until the update can be applied, restrict access to the control panel to trusted users only, as any authenticated user can exploit this vulnerability without admin privileges.

Additionally, monitor your system for suspicious activity involving the criteria parameters in requests to the element search endpoint.

Useful 0 Not Useful 0