Craft CMS contains a flaw in the element-indexes/get-elements endpoint that allows an attacker with Control Panel access to inject arbitrary SQL through the criteria[orderBy] field of a JSON request body. The unsanitized input is incorporated directly into an ORDER BY clause, enabling the attacker to read, modify, or delete data in the underlying database. This is a classic SQL Injection vulnerability described by CWE-89.

The issue affects Craft CMS versions 4.0.0‑RC1 through 4.16.17 and 5.0.0‑RC1 through 5.8.21. These releases lack input validation for the orderBy parameter. Versions 4.16.18, 5.8.22, and later include a patch that removes the vulnerable code path.

The CVSS score of 8.7 indicates high potential impact. The EPSS score of <1% implies that known exploitation attempts are extremely rare. The vulnerability is not listed in CISA’s KEV catalog. Successful exploitation requires Control Panel access and the ability to submit a request to element-indexes/get-elements; the attacker can then inject malicious SQL that runs under the database credentials of the application, allowing data exfiltration or alteration.