CVE-2026-29172: high-severity vulnerability in craftcms commerce
Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.5%
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, Craft Commerce is vulnerable to SQL Injection in the purchasables table endpoint. The sort parameter is split by | and the first part (column name) is passed directly as an array key to orderBy() without whitelist validation. Yii2's query builder does NOT escape array keys, allowing an authenticated attacker to inject arbitrary SQL into the ORDER BY clause. This vulnerability is fixed in 4.10.2 and 5.5.3.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
craftcms · commerceRelated CVEs — craftcms commerce
In the same product, most dangerous first.
CVE-2026-55795MEDIUMCraft Commerce: Coupon Code Brute-Force via Rate Limit BypassEPSS 0.5%CVE-2026-29174HIGHCraft Commerce has a SQL Injection in Commerce Inventory Table SortingEPSS 0.5%CVE-2026-32271HIGHCraft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue WidgetEPSS 0.5%CVE-2026-29173LOWCraft Commerce has Stored XSS while updating Order Status from Orders TableEPSS 0.4%CVE-2026-25482MEDIUMCraft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)EPSS 0.3%CVE-2026-25483MEDIUMCraft Commerce has Stored XSS via Order Status Message with potential database exfiltrationEPSS 0.3%