CVE-2026-31858: Craft CMS SQL Injection Vulnerability

CVE-2026-31858 Overview

CVE-2026-31858 is a SQL Injection vulnerability affecting Craft CMS, a popular content management system. The vulnerability exists in the ElementSearchController::actionSearch() endpoint, which is missing the unset() protection that was previously added to ElementIndexesController as part of the fix for CVE-2026-25495. This incomplete patch application means the exact same SQL injection attack vector remains exploitable through a different controller endpoint.

Critical Impact

Any authenticated control panel user (no admin privileges required) can inject arbitrary SQL via criteria[where], criteria[orderBy], or other query properties, potentially extracting full database contents via boolean-based blind injection.

Affected Products

• Craft CMS versions prior to 5.9.9

Discovery Timeline

• 2026-03-11 - CVE-2026-31858 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-31858

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) stems from an incomplete security fix implementation across Craft CMS controller endpoints. When CVE-2026-25495 was addressed, the unset() protection was applied to ElementIndexesController to sanitize user-controlled query criteria parameters. However, the ElementSearchController::actionSearch() endpoint was overlooked, leaving it vulnerable to the identical attack methodology.

The vulnerability allows authenticated users with access to the control panel to manipulate SQL queries through specially crafted criteria parameters. The attack can be performed via criteria[orderBy], criteria[where], or other query properties that are directly incorporated into database queries without proper sanitization. Exploitation enables boolean-based blind SQL injection, allowing attackers to systematically extract sensitive data from the entire database through conditional query responses.

Root Cause

The root cause is an incomplete security patch where the unset() protection mechanism was not uniformly applied across all affected controller endpoints. While the original vulnerability in ElementIndexesController was patched for CVE-2026-25495, the developers failed to identify and remediate the same vulnerable code pattern in ElementSearchController::actionSearch(). This represents a common security anti-pattern where similar vulnerable code exists in multiple locations but patches are applied inconsistently.

Attack Vector

The attack is network-based and requires low-privilege authentication (any control panel user). An attacker can craft malicious HTTP requests to the ElementSearchController::actionSearch() endpoint, injecting SQL syntax through the criteria parameters. Since no administrative privileges are required, any user with basic control panel access can exploit this vulnerability.

The attack proceeds through boolean-based blind injection techniques, where the attacker sends conditional SQL statements and observes application responses to infer database contents one bit at a time. This method, while slower than direct data extraction, allows complete database enumeration without requiring direct output of query results.

For technical details on the vulnerability and patch implementation, see the GitHub Security Advisory.

Detection Methods for CVE-2026-31858

Indicators of Compromise

• Unusual requests to the ElementSearchController::actionSearch() endpoint containing SQL syntax in criteria parameters
• HTTP requests with criteria[orderBy], criteria[where], or similar parameters containing SQL operators like CASE, WHEN, SELECT, or UNION
• Repeated requests to the search endpoint with slight variations in parameter values (indicative of blind injection probing)
• Database query logs showing malformed or injected SQL statements originating from the element search functionality

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in HTTP request parameters targeting Craft CMS endpoints
• Monitor application logs for requests to /actions/element-indexes/get-elements or similar search controller endpoints with suspicious criteria parameters
• Deploy database activity monitoring to identify anomalous query patterns or unauthorized data access attempts
• Utilize SentinelOne's Singularity XDR to correlate web server activity with database access patterns for early detection of exploitation attempts

Monitoring Recommendations

• Enable detailed logging for all control panel user activities, particularly search and element query operations
• Set up alerting for high-frequency requests to the element search endpoint from single user sessions
• Monitor for database query response time anomalies that may indicate blind SQL injection timing attacks
• Review access logs for authenticated users making unusual numbers of search requests

How to Mitigate CVE-2026-31858

Immediate Actions Required

• Update Craft CMS to version 5.9.9 or later immediately
• Audit control panel user accounts and remove unnecessary access privileges
• Review database access logs for signs of prior exploitation
• Implement network segmentation to limit database access from web application servers

Patch Information

Craft CMS has released version 5.9.9 which addresses this vulnerability by applying the unset() protection to the ElementSearchController::actionSearch() endpoint. The fix ensures that user-controlled criteria parameters are properly sanitized before being incorporated into database queries.

The patch can be reviewed in the GitHub Commit. Additional details are available in the GitHub Security Advisory.

Workarounds

• If immediate patching is not possible, restrict control panel access to trusted administrators only through IP allowlisting or VPN requirements
• Implement a Web Application Firewall (WAF) with rules to block SQL injection patterns in request parameters
• Disable or restrict access to the element search functionality at the web server level until patching can be completed
• Monitor all control panel user activity closely and implement additional authentication requirements such as multi-factor authentication

# Example: Restrict access to Craft CMS admin panel by IP (nginx)
location /admin {
    allow 192.168.1.0/24;
    allow 10.0.0.0/8;
    deny all;
}