The vulnerable construct allows authenticated users of the Craft control panel to inject arbitrary SQL through the getNext() and getPrev() methods, which forward user‑supplied criteria directly to Craft::configure(). This results in a blind SQL injection that can be used to exfiltrate data from the database using a timing or logical oracle.

Craft CMS versions 4.0.0 through 4.18.8 and 5.0.0 through 5.11.1 are affected. The vulnerability is present in the core CMS package, as identified by the Craft CMS CNA. Remediation requires upgrading to version 4.18.9 or later or 5.11.2 or later.

With a CVSS score of 7.1, the vulnerability is considered high severity. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog. The attack vector is likely restricted to authenticated web users with control panel access; however, because the injection is blind, an attacker would need to perform observable side‑channel techniques such as time‑based delays or conditional queries to infer database values. The lack of an immediate exploitation path does not eliminate the risk, as authenticated users can run arbitrary templates and thus leverage the vulnerability in practice.