CVE-2026-29172 - Vulnerability Analysis

Overview

Craft Commerce < 4.10.2 and < 5.5.3 contains a SQL injection caused by lack of whitelist validation on the sort parameter in the purchasables table endpoint, letting authenticated attackers inject arbitrary SQL in ORDER BY clause.

Severity & Score

Impact

Authenticated attackers can execute arbitrary SQL commands, potentially leading to data leakage or modification.

Mitigation

Upgrade to versions 4.10.2 or 5.5.3 or later.

References

• https://github.com/craftcms/commerce/security/advisories/GHSA-j3x5-mghf-xvfw
• https://github.com/craftcms/commerce/commit/b231b920b73db023e81e5b261b894d73e865c276
• https://github.com/craftcms/commerce/commit/e4e0f4107cd895d29290523637f077fe280407b1

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner