CVE-2026-31858: CraftCMS's `ElementSearchController` Affected by Blind SQL Injection
The ElementSearchController::actionSearch() endpoint is missing the unset() protection that
was added to ElementIndexesController in GHSA-2453-mppf-46cj.
The exact same SQL injection vulnerability (including criteria[orderBy], the original advisory vector) works on this controller because the fix was never applied to it.
Any authenticated control panel user (no admin required) can inject arbitrary SQL via criteria[where],
criteria[orderBy], or other query properties, and extract the full database contents via boolean-based blind injection.
Users should update to the patched 5.9.9 release to mitigate the issue.
References
- github.com/advisories/GHSA-g7j6-fmwx-7vp8
- github.com/craftcms/cms
- github.com/craftcms/cms/commit/e1a3dd669ae31491b86ad996e88a1d30d33d9a42
- github.com/craftcms/cms/security/advisories/GHSA-2453-mppf-46cj
- github.com/craftcms/cms/security/advisories/GHSA-g7j6-fmwx-7vp8
- nvd.nist.gov/vuln/detail/CVE-2026-31858
Code Behaviors & Features
Detect and mitigate CVE-2026-31858 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →