CVE-2026-123489 | Craft CMS prior 4.18.9/5.11.2 getNext/getPrev Craft::configure elementIds sql injection

November 6, 2026 Yanac

A vulnerability labeled as critical has been found in Craft CMS. Affected by this issue is the function Craft::configure of the component getNext/getPrev. Executing a manipulation of the argument elementIds can lead to sql injection.

This vulnerability appears as CVE-2026-123489. The attack may be performed from remote. There is no available exploit.

The affected component should be upgraded.VulDB Recent EntriesRead More