Wheels Framework: SQL injection via quote handling in model lookups
Summary
Wheels is an open-source MVC framework for CFML (ColdFusion and Lucee). Versions 1.1.8 through 4.1.1 do not correctly handle doubled single quotes in values passed to dynamic finders, query-builder where conditions, key-based lookups and uniqueness validation, so request data can change the SQL query. An unauthenticated remote attacker can exploit this if the application passes request data to these APIs, for example in login, password-reset or token lookups, and could read or enumerate data and bypass these lookups. Numeric columns are not affected.
Affected
- Wheels 1.1.8 through 4.1.1
- Affected APIs: dynamic finders (e.g. findOneByEmail), query builder where(property, value) and where(property, operator, value), findByKey, updateByKey, deleteByKey, findOrCreateBy, validatesUniquenessOf
- Additionally, query builder whereBetween() in 4.0.0 through 4.1.1 on MySQL/MariaDB with backslash escaping enabled
Fixed in
- Fixed in Wheels 4.1.2
- For MySQL/MariaDB users of whereBetween(): check the target version 4.2.0, as a separate CVE (CVE-2026-111444) reports a related issue fixed in 4.2.0
- Versions before 1.1.8: unknown
Workaround
- Validate and whitelist request values before passing them to the affected APIs
- Look up records by numeric primary key where possible
- Use where with explicit parameter binding where possible
- No vendor workaround is documented; upgrading is the only complete remedy
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total
- No confirmed active exploitation found in the sources reviewed
- No public proof of concept found; the advisory describes the mechanism
- The CISA KEV catalogue was not verified
Our recommendation
- Inventory all Wheels/CFML applications and their versions
- Upgrade to Wheels 4.1.2 at minimum, and to 4.2.0 if MySQL/MariaDB and whereBetween() are used
- Review authentication, password-reset and token lookup code that passes request data to the affected APIs
- Check web and application logs for anomalous query errors or unusual authentication patterns
- Treat internet-facing applications on affected versions as high priority
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-96rm-h22v-925x github.com
- Wheels release v4.1.2 github.com
- OSV CVE-2026-110911 osv.dev
- OSV CVE-2026-111444 osv.dev
- VulDB CVE-2026-110911 vuldb.com
- Wheels blog blog.wheels.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:54.
Original description (NVD)
Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup paths (findByKey, updateByKey, deleteByKey and findOrCreateBy...), and validatesUniquenessOf. The parser incorrectly treats a doubled single quote as the end of a literal. Applications passing request data to these APIs can expose authentication, password-reset or token lookups, and data to unauthorized access; numeric-column values are not affected. There is a similar concern for query-builder whereBetween() in 4.0.0 through 4.1.1: string/date bounds can alter SQL on MySQL/MariaDB with backslash escaping enabled. This is fixed in 4.1.2.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.