CVE-2026-33162: Craftcms Query Criteria Sqli
Directly configuring objects using request data (via Component::cleanseConfig) without filtering out restricted SQL criteria properties (e.g., 'where', 'union') exposes the application to SQL Injection. Ensure that unsafe array keys are unset before applying the criteria.
Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0php
greprules fetch cve-2026-33162-craftcms-query-criteria-sqli --engine opengrepDescription
Directly configuring objects using request data (via Component::cleanseConfig) without filtering out restricted SQL criteria properties (e.g., 'where', 'union') exposes the application to SQL Injection. Ensure that unsafe array keys are unset before applying the criteria.
Detection target
Not provided
Recommended fix
Not provided
False-positive notes
Not provided
Community feedback
Sign in to report false positives, mark this rule useful, or suggest metadata improvements.