GHSA-r54v-qq87-px5r

Source

https://github.com/advisories/GHSA-r54v-qq87-px5r

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-r54v-qq87-px5r/GHSA-r54v-qq87-px5r.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-r54v-qq87-px5r

Aliases

CVE-2026-32272

Related

CVE-2026-32272

Published

2026-04-14T00:06:56Z

Modified

2026-04-15T04:59:57Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Craft Commerce hasVariant/hasProduct Blind SQL Injection

Details

Overview

Craft Commerce’s ProductQuery::hasVariant and VariantQuery::hasProduct properties bypass the unset() blocklist added to ElementIndexesController in GHSA-2453-mppf-46cj.

The blocklist only strips top-level Yii2 Query properties (where, orderBy, etc.), but hasVariant and hasProduct pass through untouched. Internally, these properties call Craft::configure() on a subquery without sanitization, re-introducing SQL injection via criteria[hasVariant][where]=INJECTED_SQL.

An authenticated control panel user can perform boolean-based blind SQL injection through the patched ElementIndexesController and extract arbitrary database contents.

Impact

Full database read access via blind SQL injection
Privilege escalation via security key extraction → forged admin sessions

Prerequisites

Authenticated control panel user
Commerce plugin installed
Products with variants in the database

Database specific

{
    "cwe_ids": [
        "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-14T00:06:56Z",
    "nvd_published_at": "2026-04-13T21:16:24Z",
    "severity": "HIGH"
}

References

Affected packages

Packagist / craftcms/commerce

Package

Name: craftcms/commerce
Purl: pkg:composer/craftcms/commerce

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.0.0

Fixed

5.6.0

Affected versions

5.*

5.0.0

5.0.1

5.0.2

5.0.3

5.0.4

5.0.5

5.0.6

5.0.7

5.0.8

5.0.9

5.0.10

5.0.10.1

5.0.11

5.0.11.1

5.0.12

5.0.12.1

5.0.12.2

5.0.13

5.0.14

5.0.15

5.0.16

5.0.16.1

5.0.16.2

5.0.17

5.0.18

5.0.19

5.1.0-beta.1

5.1.0-beta.2

5.1.0-beta.3

5.1.0

5.1.0.1

5.1.1

5.1.2

5.1.3

5.1.4

5.2.0

5.2.1

5.2.2

5.2.2.1

5.2.3

5.2.4

5.2.5

5.2.6

5.2.7

5.2.8

5.2.9

5.2.9.1

5.2.10

5.2.11

5.2.12

5.2.12.1

5.3.0

5.3.0.1

5.3.0.2

5.3.1

5.3.2

5.3.2.1

5.3.2.2

5.3.3

5.3.4

5.3.5

5.3.6

5.3.7

5.3.8

5.3.9

5.3.10

5.3.11

5.3.12

5.3.13

5.4.0

5.4.1

5.4.1.1

5.4.2

5.4.3

5.4.4

5.4.5

5.4.5.1

5.4.6

5.4.7

5.4.7.1

5.4.8

5.4.9

5.4.10

5.5.0

5.5.0.1

5.5.1

5.5.2

5.5.3

5.5.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-r54v-qq87-px5r/GHSA-r54v-qq87-px5r.json"