CVE-2026-31858
CraftCMS's `ElementSearchController` Affected by Blind SQL Injection
Impact
The `ElementSearchController::actionSearch()` endpoint is missing the `unset()` protection that was added to ElementIndexesController in [GHSA-2453-mppf-46cj](https://github.com/craftcms/cms/security/advisories/GHSA-2453-mppf-46cj). The exact same SQL injection vulnerability (including `criteria[orderBy]`, the original advisory vector) works on this controller because the fix was never applied to it. Any authenticated control panel user (no admin required) can inject arbitrary SQL via `criteria[where]`, `criteria[orderBy]`, or other query properties, and extract the full database contents via boolean-based blind injection. Users should update to the patched 5.9.9 release to mitigate the issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | craftcms/cms | >= 5.0.0-RC1, <= 5.9.8 | 5.9.9 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Craftcms | Craft Cms | from 5.0.1 before 5.9.9 Version 5.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/craftcms/cms/commit/e1a3dd669ae31491b86ad996e88a1d30d33d9a42
- https://github.com/craftcms/cms/security/advisories/GHSA-g7j6-fmwx-7vp8
- https://github.com/advisories/GHSA-g7j6-fmwx-7vp8
- https://github.com/craftcms/cms/security/advisories/GHSA-2453-mppf-46cj
- https://nvd.nist.gov/vuln/detail/CVE-2026-31858