CVE-2026-123488 | Craft CMS 4.0.0-4.18.8/5.0.0-5.11.1 Element Search attribute sql injection

A vulnerability was found in Craft CMS 4.0.0-4.18.8/5.0.0-5.11.1 and classified as critical. Affected by this issue is some unknown functionality of the component Element Search. Such manipulation of the argument attribute leads to sql injection.

This vulnerability is referenced as CVE-2026-123488. It is possible to launch the attack remotely. No exploit is available.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More