Search: CVE-2026-25495

CVE-2026-25495 is a high-severity SQL Injection vulnerability in Craft CMS versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21. The flaw exists in the element-indexes/get-elements endpoint, specifically via the criteria[orderBy] parameter in the JSON request body, which is not properly sanitized before being used in an SQL ORDER BY clause.