CVE-2026-110911: Unauthenticated SQL Injection in Wheels CFML Framework

Overview

A critical SQL injection vulnerability has been disclosed in Wheels, the Model-View-Controller (MVC) framework widely used to build applications on ColdFusion and Lucee (CFML). Tracked as CVE-2026-110911 with a maximum-severity CVSS score of 9.8, the flaw allows an unauthenticated, remote attacker to inject arbitrary SQL through several of the framework's most commonly used data-access functions.

The root cause is a parsing defect: when Wheels re-parses a caller-supplied quoted value as SQL, it incorrectly treats a doubled single quote ('') as the end of a string literal rather than as an escaped character inside the value. That misparse lets an attacker break out of the intended query context and append their own SQL.

Technical Details

How It Works

The doubled-single-quote misparse surfaces across a wide range of entry points that Wheels exposes to application code, meaning the attack surface is as broad as the framework's own public API:

• Dynamic finders — functions such as findOneByEmail that build queries directly from caller-supplied identifiers
• Query Builder — where(property, value) and where(property, operator, value), including the whereBetween function specifically called out in the advisory
• Key-based lookups — findByKey, updateByKey, deleteByKey, and findOrCreateBy... variants that accept string or UUID keys
• validatesUniquenessOf — the built-in validation helper used to enforce column uniqueness

Because none of these require prior authentication, any application endpoint that passes user input into a dynamic finder, a where() call, or a uniqueness validator is a potential injection point — including public-facing login, search, and registration forms.

Impact Assessment

Mitigation

Immediate Actions

• Upgrade to Wheels 4.1.2 or later, which corrects the quote-parsing logic.
• Where an immediate upgrade isn't possible, audit any code path that passes user-controlled strings into dynamic finders, where(), whereBetween(), key-based lookups, or validatesUniquenessOf, and apply parameterized queries or manual input sanitization as a stopgap.
• Review database user permissions for the application account — least-privilege access limits the blast radius of any injection that slips through before patching.

Detection Opportunities

• Monitor database and application logs for malformed or unexpectedly long query parameters, repeated single-quote sequences, or SQL keywords appearing in fields that should contain plain identifiers (emails, keys, UUIDs).
• Web application firewall (WAF) rules tuned for classic SQL injection payloads (quote-escape sequences, UNION, comment terminators) provide partial coverage while patching is rolled out.

Defence-in-Depth

• Enforce parameterized queries at the data-access layer wherever custom SQL is still hand-written alongside Wheels' built-in helpers.
• Keep CFML runtime (ColdFusion/Lucee) and all third-party Wheels plugins current, since framework-level injection flaws are a common target for automated scanning once disclosed.

Discovery & Disclosure

The vulnerability was disclosed via a GitHub Security Advisory published by the Wheels maintainers (GHSA-96rm-h22v-925x) on October 15, 2026. As of publication, CVE-2026-110911 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and no public proof-of-concept exploit has been confirmed — but given the unauthenticated, zero-interaction attack path and the maximum CVSS score, organizations running affected Wheels versions should treat upgrading as urgent.

References

• NVD — CVE-2026-110911
• GitHub Security Advisory — GHSA-96rm-h22v-925x
• Strix — CVE-2026-110911: Wheels SQL Injection