CVE-2026-110911

Executive Summary

CVE-2026-110911 is a critical SQL injection vulnerability (CVSS 9.8) in the Wheels CFML (ColdFusion) framework, affecting versions 1.1.8 through 4.1.1. The flaw allows unauthenticated attackers to inject arbitrary SQL through dynamic finders, query builder methods, key-based lookup paths, and uniqueness validation. Applications that pass caller-supplied request data to these APIs — particularly authentication, password-reset, and token lookup flows — may be exposed to unauthorized data access, credential theft, and full database compromise.

Technical Analysis

The vulnerability resides in Wheels' SQL literal parser, which incorrectly treats a doubled single quote ('') as the end of a string literal rather than as an escaped quote character. In SQL, '' is the standard escape sequence for a literal single quote inside a quoted string. By misparsing this sequence, Wheels terminates the literal prematurely, allowing any SQL that follows to be interpreted as query syntax rather than data.

This parsing flaw manifests across multiple API surfaces:

1. Dynamic finders such as findOneByEmail — these methods construct queries from property names and values. When caller-supplied values contain quoted strings with embedded escaped quotes, the parser breaks out of the literal and injects SQL.
2. Query builder methods where(property, value) and where(property, operator, value) — these accept values directly from callers and pass them through the flawed parser.
3. String/UUID-key lookup paths — findByKey, updateByKey, deleteByKey, and findOrCreateBy... — these paths handle string and UUID keys, which are string-typed and therefore subject to the same literal-parsing flaw. Numeric-column values are explicitly unaffected because they are not parsed as string literals.
4. validatesUniquenessOf — this validation method runs a SQL query to check for duplicate values. If the value being validated is caller-supplied and contains a quoted string with escaped quotes, SQL injection is possible.

A distinct but related issue affects whereBetween() in versions 4.0.0 through 4.1.1: string and date bounds can alter SQL on MySQL/MariaDB when backslash escaping is enabled. In MySQL/MariaDB, the backslash (\) is an alternative escape character, which can interact with the parser's quote handling to produce injection.

The root cause is a string-literal parsing error, not a lack of parameterization per se. The parser fails to correctly recognize the doubled-single-quote escape sequence, causing a state-machine error where the parser transitions out of "inside literal" state prematurely. This is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) instantiated as a parser-level flaw rather than a simple concatenation issue.

Attack surface: Any Wheels application that routes user-controlled input to these APIs. The most dangerous surfaces are authentication flows (e.g., findOneByEmail on a login form), password-reset token lookups, and API endpoints that accept string keys. Because the vulnerability is in the framework's core query-building layer, it is not limited to a single endpoint — any application code using these methods with untrusted input is potentially vulnerable.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and the APIs described in the NVD entry.

1. Reconnaissance / Target Identification: An attacker identifies a Wheels-based CFML application (often identifiable via HTTP response headers, error pages, or framework-specific URL patterns). The attacker enumerates endpoints that accept string parameters — login forms, password-reset forms, API endpoints accepting IDs or keys.

2. Triggering the Flaw: The attacker supplies a crafted string value to any parameter that the application passes to a vulnerable API. Based on the described parser behavior, the payload contains a doubled single quote ('') embedded within a quoted value. The parser misinterprets the '' as the end of the literal, allowing the attacker's trailing SQL to be interpreted as query syntax. For whereBetween() on MySQL/MariaDB, the attacker crafts string or date bounds leveraging backslash escaping (\) to alter the SQL structure.

3. Payload / Execution Method: At the vulnerability-class level, this is a classic SQL injection enabling boolean-based, union-based, or error-based extraction. Because the flaw is in the parser, the injection may bypass typical input sanitization that only targets single quotes — the doubled quote is the trigger, not a single quote. The attacker can target login queries (e.g., authentication lookup by email) to bypass authentication, or target token lookups to hijack password-reset flows.

4. Post-Exploitation Impact: Successful exploitation can yield unauthorized access to authentication data, password-reset tokens, and arbitrary application data. With sufficient database privileges, the attacker could read, modify, or delete data; in some configurations, escalate to OS-level command execution via database features (e.g., xp_cmdshell on MSSQL, LOAD_FILE/INTO OUTFILE on MySQL). The CVSS vector (C:H/I:H/A:H) indicates full confidentiality, integrity, and availability impact.

Impact Assessment

CVSS 3.1 Base Score: 9.8 (Critical) — Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (Network): Exploitable remotely without local access.
• Attack Complexity (Low): No special conditions required beyond the presence of a vulnerable code path.
• Privileges Required (None): No authentication needed.
• User Interaction (None): No victim action required.
• Scope (Unchanged): Impact confined to the vulnerable component's security authority.
• Confidentiality/Integrity/Availability (High): Full compromise of data confidentiality, integrity, and availability.

Business impact: Wheels is a CFML MVC framework used for web applications. Affected systems include any public-facing Wheels application that passes request data to the described APIs. Blast radius includes all data accessible to the application's database user — potentially customer PII, credentials, tokens, and business records. Authentication bypass and password-reset hijacking can lead to full account takeover. Because the framework is the vulnerable component, patching requires upgrading the framework, not just individual applications. No EPSS score is available (not yet scored by FIRST.org). CVE is not in CISA KEV.

Detection Guidance

Sigma Rule

title: Wheels Framework SQL Injection via Doubled Single Quote
id: 9f2c7e14-3b8a-4d6f-a1e2-7c5b9d0f4a21
status: experimental
description: Detects SQL injection attempts targeting Wheels framework APIs where a doubled single quote is used to break out of string literals.
logsource:
  category: webserver
detection:
  selection_method:
    cs-uri-query|contains:
      - "''"
  selection_params:
    cs-uri-query|contains:
      - "email="
      - "key="
      - "token="
      - "id="
      - "where"
  condition: selection_method and selection_params
falsepositives:
  - Legitimate input containing two consecutive single quotes (rare but possible in names or free-text fields)
level: high
tags:
  - attack.t1190
  - cwe.89

YARA Rule

rule CVE_2026_110911_Wheels_SQLi
{
    meta:
        description = "Detects Wheels framework SQL injection patterns using doubled single quotes"
        author = "Threat Intel"
        date = "2026-01-01"
        reference = "CVE-2026-110911"
        severity = "critical"
    strings:
        $a1 = "findOneBy"
        $a2 = "findByKey"
        $a3 = "updateByKey"
        $a4 = "deleteByKey"
        $a5 = "findOrCreateBy"
        $a6 = "validatesUniquenessOf"
        $a7 = "whereBetween"
        $b1 = "''"
        $c1 = "SELECT"
        $c2 = "UNION"
        $c3 = "OR 1=1"
    condition:
        (any of ($a*)) and ($b1 or any of ($c*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110911 Wheels Framework SQL Injection Attempt"; flow:established,to_server; http.uri; content:"''"; http.uri; content:"email="; nocase; http.uri; content:"key="; nocase; distance:0; within:50; classtype:web-application-attack; reference:cve,2026-110911; sid:2026110911; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where http.request.method == "GET" or http.request.method == "POST"]
  [network where http.request.body.content : "*''*" and (http.request.body.content : "*email*" or http.request.body.content : "*token*" or http.request.body.content : "*key*")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=cfml
| eval uri=urldecode(uri)
| where match(uri, "''") AND (match(uri, "(?i)email=") OR match(uri, "(?i)key=") OR match(uri, "(?i)token=") OR match(uri, "(?i)where"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, status
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="web,sql_injection,wheels,">
  <rule id="2026110" level="12">
    <if_sid>31100</if_sid>
    <url>''</url>
    <description>CVE-2026-110911: Possible Wheels framework SQL injection attempt via doubled single quote</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_89,sql_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Upgrade Wheels to version 4.1.2, the version explicitly identified as containing the fix.
   • Until upgrade is possible: audit all application code that passes request data to findOneBy*, findByKey, updateByKey, deleteByKey, findOrCreateBy*, validatesUniquenessOf, where(property, value), where(property, operator, value), and whereBetween().
   • Apply strict input validation and allow-listing on all parameters routed to these APIs; reject any input containing single-quote characters.
   • For whereBetween() on MySQL/MariaDB, ensure backslash escaping is disabled (e.g., NO_BACKSLASH_ESCAPES SQL mode) as a compensating control.
   • Deploy WAF rules to detect doubled-single-quote patterns in request parameters.

2. Patch / Upgrade Steps:

   • Update the Wheels framework dependency to 4.1.2 or later using your normal package management process.
   • Re-test all application flows that use the affected APIs (authentication, password reset, token lookups, key-based CRUD).
   • Verify the parser handles doubled single quotes correctly after upgrade.

3. Long-Term Hardening:

   • Enforce parameterized queries throughout application code; avoid dynamic finders with caller-supplied strings.
   • Adopt the principle of least privilege for database users.
   • Monitor for CVE-specific exploit attempts using the detection rules above.
   • Track vendor advisories for Wheels and subscribe to NVD/OSV feeds for framework-level CVEs.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-110911
2. CWE-89: Improper Neutralization of Special Elements used in an SQL Command: https://cwe.mitre.org/data/definitions/89.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. Wheels Framework Official Documentation: https://wheels.dev/
5. OWASP SQL Injection Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html

No public PoC or exploit code is available. No threat actor campaigns or exploit-in-the-wild evidence have been reported. CVE-2026-110911 is not listed in CISA KEV.