Description

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an SQL injection vulnerability in GraphQL eager-loading: arguments on eager-loadable nodes absent from the public schema are copied into EagerLoadPlan criteria without cleansing. Unauthenticated attackers can supply a parenthesized select argument to inject SQL expressions and read arbitrary database content, including password hashes and session tokens.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-11-06T15:17:18.663Z",
  "pubdate": "2026-11-06T15:17:18.663Z",
  "executiveSummary": "Craft CMS versions 4.0.0 through 4.18.8 and 5.0.0 through 5.11.1 are susceptible to an SQL injection vulnerability located within the GraphQL eager-loading mechanism.\nThe vulnerability allows unauthenticated remote attackers to execute arbitrary SQL queries against the underlying database by injecting malicious payloads into specific GraphQL arguments.\nThe root cause stems from the improper sanitization of arguments associated with eager-loadable nodes that are not explicitly defined within the public schema, leading to their inclusion in the EagerLoadPlan criteria.\nSuccessful exploitation facilitates unauthorized access to sensitive database information, including password hashes, session tokens, and other confidential system data.\nThe flaw poses a critical security risk to the confidentiality and integrity of the application, as it bypasses standard authorization checks to interact directly with the database layer.\nGiven the nature of GraphQL interfaces, the attack can be executed over the network without requiring any prior authentication, making it a high-priority exposure for publicly accessible Craft CMS instances.",
  "technicalDetails": "The vulnerability resides in the way Craft CMS processes GraphQL eager-loading requests. When a request is made, the system evaluates nodes for eager loading; however, it fails to sufficiently cleanse arguments for nodes that are absent from the public schema.\nThese unsanitized arguments are subsequently passed into the 'EagerLoadPlan' criteria. Because the application logic does not validate or parameterize these inputs before they are utilized to build database queries, an attacker can manipulate the query structure.\nThe attack vector involves crafting a malicious GraphQL query that includes a parenthesized 'select' argument. By embedding SQL expressions within these arguments, an attacker forces the database to execute unintended commands.\nBecause the input is incorporated directly into the 'EagerLoadPlan' criteria without sanitization, the application fails to treat the input as literal data, instead interpreting it as executable SQL code.\nStep-by-step exploitation: 1. The attacker identifies an eager-loadable GraphQL node that does not exist in the public schema but remains accessible to the underlying parsing engine. 2. The attacker crafts a request containing an injected SQL statement within the node's arguments. 3. The GraphQL layer processes the node and propagates the unsanitized input into the 'EagerLoadPlan' logic. 4. The system constructs an SQL query that includes the attacker's payload. 5. The database executes the injected payload, potentially returning sensitive data such as password hashes or active session tokens in the GraphQL response body.\nThe lack of authentication requirements means that any remote user capable of interacting with the CMS GraphQL endpoint can trigger this vulnerability. The impact is significant, as the ability to extract administrative credentials or session tokens can lead to full site compromise and persistent unauthorized access to the CMS administrative control panel.\nThis vulnerability highlights a critical failure in the boundary between user-supplied GraphQL arguments and the internal database query construction mechanism, specifically within the eager-loading subsystem of Craft CMS versions 4.0.0 through 4.18.8 and 5.0.0 through 5.11.1."
}