CVE-2026-29172 Craft Commerce has a SQL Injection in Commerce Purchasables Table Sorting
An authenticated attacker can inject arbitrary SQL into the ORDER BY clause of the purchasables table endpoint, potentially reading or modifying data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-29172?
CVE-2026-29172 is a high-severity SQL injection vulnerability in craftcms commerce, published on 10 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, Craft Commerce is vulnerable to SQL Injection in the purchasables table endpoint. The sort parameter is split by | and the first part (column name) is passed directly as an array key to orderBy() without whitelist validation. Yii2's query builder does NOT escape array keys, allowing an authenticated attacker to inject arbitrary SQL into the ORDER BY clause. This vulnerability is fixed in 4.10.2 and 5.5.3.
Weakness: CWE-89
Which versions are affected by CVE-2026-29172?
4 open source packages ship an affected version, including craftcms/commerce. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
craftcms/commerce Packagist | From 4.0.0 | 4.10.2 |
craftcms/commerce Packagist | From 4.0.0 | 4.10.2 |
craftcms/commerce Packagist | From 5.0.0 | 5.5.3 |
craftcms/commerce Packagist | From 5.0.0 | 5.5.3 |
Products include Craftcms Craft Commerce.
How do I fix CVE-2026-29172?
Upgrade craftcms/commerce to a fixed version for your release line: 4.10.2 or 5.5.3.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-29172 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-29172 exists.
Other vulnerabilities in craftcms commerce
- CVE-2026-29174 Craft Commerce has a SQL Injection in Commerce Inventory Table Sorting
- CVE-2026-29175 Multiple Stored XSS in Commerce Inventory Page Leading to Session Hijacking
- CVE-2026-31867 Craft Commerce has a Potential IDOR in Commerce carts
- CVE-2026-25482 Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)
- CVE-2026-25483 Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration
Sources
Also known as GHSA-j3x5-mghf-xvfw.