← Vulnerability feed

Vulnerability record · CVE-2026-29172 · published 10 March 2026

CVE-2026-29172: Craftcms craft commerce sql injection vulnerability

Craftcms · Craft Commerce

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, Craft Commerce is vulnerable to SQL Injection in the purchasables table endpoint. The sort parameter is split by | and the first part (column name) is passed directly as an array key to orderBy() without whitelist validation. Yii2's query builder does NOT escape array keys, allowing an authenticated attacker to inject arbitrary SQL into the ORDER BY clause. This vulnerability is fixed in 4.10.2 and 5.5.3.

8.7 CVSS 4.0 High EPSS 0.52% · top 58.0% CWE-89 · SQL injection
8.7CVSS 4.0 base score
0.52%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, Craft Commerce is vulnerable to SQL Injection in the purchasables table endpoint. The sort parameter is split by | and the first part (column name) is passed directly as an array key to orderBy() without whitelist validation. Yii2's query builder does NOT escape array keys, allowing an authenticated attacker to inject arbitrary SQL into the ORDER BY clause. This vulnerability is fixed in 4.10.2 and 5.5.3.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/craftcms/commerce/commit/b231b920b73db023e81e5b261b894d73e865c276 Patch
https://github.com/craftcms/commerce/commit/e4e0f4107cd895d29290523637f077fe280407b1 Patch
https://github.com/craftcms/commerce/security/advisories/GHSA-j3x5-mghf-xvfw ExploitVendor Advisory
https://github.com/craftcms/commerce/security/advisories/GHSA-j3x5-mghf-xvfw ExploitVendor Advisory

Track CVE-2026-29172 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2026-29174Craftcms craft commerce sql injection vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Craft Commerce is vulnerable to SQL Injection in the inventory levels table da…EPSS 0.52%8.6CVE-2026-29175Craftcms craft commerce cross-site scripting vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Stored XSS vulnerabilities exist in the Commerce Inventory page. The Product T…EPSS 0.25%6.3CVE-2026-31867Craftcms craft commerce insecure direct object reference vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. Prior to 4.11.0 and 5.6.0, An Insecure Direct Object Reference (IDOR) vulnerability exists in …EPSS 0.32%6.2CVE-2026-25485Craftcms craft commerce cross-site scripting vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Cr…EPSS 0.35%6.2CVE-2026-25482Craftcms craft commerce cross-site scripting vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored DOM XSS vulnerability e…EPSS 0.41%6.2CVE-2026-25483Craftcms craft commerce cross-site scripting vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability exist…EPSS 0.39%6.1CVE-2026-25522Craftcms craft commerce cross-site scripting vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, a stored XSS vulnerability in Cr…EPSS 0.35%6.1CVE-2026-25486Craftcms craft commerce cross-site scripting vulnerabilityCraft Commerce is an ecommerce platform for Craft CMS. From version 5.0.0 to 5.5.1, a stored XSS vulnerability in Craft Commerce allows attackers to …EPSS 0.34%

Source: NIST National Vulnerability Database (record CVE-2026-29172), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.