Craft CMS SQL injection gets a new CVE record, fixes remain 4.18.9 and 5.11.2
Fresh record, older fix. VulnCheck published the CVE-2026-123488 record on November 6, 2026. Craft’s underlying GHSA-qcvp-ggx3-97r6 advisory was published on October 22. This is not a new November patch or proof of exploitation in the wild.
Scope and impact
The vendor advisory identifies unauthenticated SQL injection in the element search endpoint, allowing database read and write access and escalation to an administrator. Its explanation identifies unsanitized query construction combined with emulated PDO prepares. No exploit requests or database-modification steps are supplied here.
Both the vendor advisory and CNA record identify affected Craft CMS 4 versions from 4.0.0 up to, but excluding, 4.18.9, and Craft CMS 5 versions from 5.0.0 up to, but excluding, 5.11.2. The fixed versions are 4.18.9 and 5.11.2 on the respective branches.
Scores need their labels
VulnCheck assigns CVSS 4.0 9.3 and CVSS 3.1 9.8 in its CNA record. The vendor’s GitHub advisory labels severity High and, in the retrieved page, still displays no known CVE. The CNA links that exact advisory. Do not silently turn a CNA numerical score into a vendor score.
Defensive response
Inventory the installed craftcms/cms Composer package, rather than relying on the marketing version of a site theme or a remote banner. Back up the database and application, follow the supported update process to the correct patched branch and verify the deployed artifact. Review unexpected administrator changes and account activity if prior exposure is suspected. Updating does not establish that a previously exposed database was never altered.
No exploit validation is necessary to prioritize a known affected package. Slow paws, fast dependency inventory.
