Is CVE-2026-123489 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123489 being exploited in the wild.

How severe is CVE-2026-123489?

High severity, with a CVSS score of 7.1, published 6 November 2026.

Which products and versions are affected?

Craft CMS 4.0.0 to 4.18.8, 5.0.0 to 5.11.1.

Is there a fix for CVE-2026-123489?

Yes: fixed in Craft CMS 4.18.9, 5.11.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-123489 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-123489?

Check whether you run Craft CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123489: Craft CMS SQL injection in getNext/getPrev methods

CVE-2026-123489 · Severity: high · CVSS 7.1 · Published 2026-11-06

Craft CMS is a content management system used to build websites and applications. Authenticated control panel users can exploit a blind SQL injection vulnerability through specially crafted template inputs to execute arbitrary SQL queries and extract data from the Craft database. This requires an attacker to already have control panel access, limiting the immediate threat but allowing data exfiltration once inside.

Technologies: Craft CMS. Vendors: Craft CMS.

Quick answers

Is CVE-2026-123489 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123489 being exploited in the wild.
How severe is CVE-2026-123489?: High severity, with a CVSS score of 7.1, published 6 November 2026.
Which products and versions are affected?: Craft CMS 4.0.0 to 4.18.8, 5.0.0 to 5.11.1.
Is there a fix for CVE-2026-123489?: Yes: fixed in Craft CMS 4.18.9, 5.11.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123489 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-123489?: Check whether you run Craft CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Craft CMS 4.18.9, 5.11.2

Technical details

The vulnerability exists in the getNext() and getPrev() methods exposed to the Twig sandbox, which pass arbitrary criteria arrays to Craft::configure() without filtering SQL-bearing properties like orderBy and where. Attackers authenticated to the control panel can supply a crafted elementIds value that bypasses ComponentHelper::cleanseConfig() filtering and executes as a raw SQL order expression when the element query calls ids(). This is a blind SQL injection requiring control panel authentication but providing a reliable conditional SQL oracle under the database account running Craft.

Affected products

Craft CMS Craft CMS 4.0.0 to 4.18.8, 5.0.0 to 5.11.1

Timeline

2026-10-22: disclosed
2026-11-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.