SQL Injection Vulnerability in Craft Commerce by Craft CMS

CVE-2026-29174

What is CVE-2026-29174?

Craft Commerce, the ecommerce platform for Craft CMS, is susceptible to a SQL Injection flaw in its inventory levels table data endpoint prior to version 5.5.3. By exploiting the lack of validation and sanitization in the handling of the sort parameters, an authenticated attacker with access to the Commerce Inventory section may be able to execute arbitrary SQL queries. This could potentially compromise the entire database, exposing sensitive data and allowing for severe security breaches. The vulnerability has been remedied in version 5.5.3.

References