Craft CMS fixes critical SQL injection, with 5.11.5 now the line to run

Craft CMS fixes critical SQL injection, with 5.11.5 now the line to run

10 November 2026: Craft CMS 5.11.2 and 4.18.9 fix a critical SQL injection that leads to privilege escalation (GHSA-qcvp-ggx3-97r6) and an unauthenticated SQL injection through GraphQL, among two critical and six high flaws counted by Italy's CSIRT, with no exploitation reported. Sites on the 5.x line should go past those versions to 5.11.5, which carries two further fixes.

Not yet independently verified. CSIRT Italia lists the CVE numbers and the Craft CMS advisories list the flaws, but the GitHub entries carry no CVE, so we could not match each number to each advisory. No exploitation has been reported in either source. We will update this when it can be confirmed, and remove this note.

The flaws that need no login

CSIRT Italia's alert of 9 November covers CVE-2026-124427 to 124430 and CVE-2026-123488 to 123491 and warns that some can be used without authentication. The worst effects it lists are security bypass, privilege escalation, access to sensitive information and arbitrary code execution.

GHSA-mjj9-pjh4-r48g is the one that most changes the risk for a public site. It allows SQL injection through GraphQL eager-load select criteria by an unauthenticated user, so a site that exposes a public GraphQL schema should be treated as directly reachable.

Paths from a low-privileged account to code execution

Several of the other advisories start from some access and end somewhere much worse:

• GHSA-qcvp-ggx3-97r6, critical: SQL injection leading to privilege escalation
• GHSA-qj3q-j7r4-428p, high: the app/render-elements return URL signing oracle leads to remote code execution, on 5.10.0 up to 5.11.2
• GHSA-r56r-f696-c8w9, high: admin privilege escalation through the sandbox getOwners criteria, on 5.8.17 up to 5.11.2
• GHSA-xpg7-m6gm-4xfh and GHSA-mp59-9rf5-93wr, medium: disclosure through GraphQL

A content editor's account is commonly shared with agencies and freelancers on a Craft site, which is why an authenticated bug in a CMS matters more than the label suggests.

Two more fixes after the first round

The vendor's first advisories appeared on 22 and 23 October. On 2 November it published GHSA-cphx-cx67-jcqj, an authenticated SQL injection through Element::findOne() array criteria fixed in 5.11.5, and GHSA-hq78-cm2m-h24h, a bypass of the image transform class guard leading to remote code execution, fixed in 5.11.4. A team that patched in October to 5.11.2 is still exposed to both.

Versions to install

• Craft 5.x: 5.11.5 or later
• Craft 4.x: 4.18.9 or later

After upgrading, review admin accounts created in recent weeks and rotate the security key if the site exposed a public GraphQL endpoint before the fix. Our headless CMS software category lists seven products.

Company profile on TrustList: Craft CMS

Related on TrustList:

• WordPress update race flaw CVE-2026-119977 is now being exploited

Sources

• CSIRT Italia: AL03/261109, resolved vulnerabilities in Craft CMS, 9 November 2026
• Craft CMS security advisories on GitHub, 2 November 2026