CVE-2026-44012: Craftcms Query Configure Sqli
Direct configuration of database query builders via `Craft::configure()` using unsanitized user criteria arrays can lead to SQL injection. An attacker can inject arbitrary SQL fragments by including keys like 'where', 'join', or 'having'. Ensure that unsafe array keys are unset from the criteria array prior to configuration.
PHPgreprules fetch cve-2026-44012-craftcms-query-configure-sqli --engine opengrepDescription
Direct configuration of database query builders via `Craft::configure()` using unsanitized user criteria arrays can lead to SQL injection. An attacker can inject arbitrary SQL fragments by including keys like 'where', 'join', or 'having'. Ensure that unsafe array keys are unset from the criteria array prior to configuration.
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.