Vulnerabilities in Wheels
11 resultsCVE-2026-110911CRITICALWheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOEPSS 0.3%CVE-2026-111447HIGHWheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being savEPSS 0.3%CVE-2026-111445HIGHWheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). ForEPSS 0.3%CVE-2026-111446HIGHWheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it EPSS 0.3%CVE-2026-111444CRITICALWheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an applicationEPSS 0.3%CVE-2026-111449MEDIUMWheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administratoEPSS 0.2%CVE-2026-111448LOWWheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checksEPSS 0.2%CVE-2026-111443MEDIUMWheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in productionEPSS 0.2%CVE-2026-111451HIGHWheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollbEPSS 0.1%CVE-2026-111450MEDIUMWheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If EPSS 0.1%CVE-2026-110909MEDIUMWheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A proEPSS 0.1%