Wheels SQL injection leaks database data (CVE-2026-111444) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-111444 is a critical SQL injection flaw in Wheels through 4.1.2 that lets an attacker alter inline-literal query paths on MySQL and MariaDB and read or modify database data. Fixed in Wheels 4.2.0 - upgrade immediately.

Overview

Wheels is a CFML (ColdFusion Markup Language) MVC framework used to build web applications on Adobe ColdFusion and Lucee. This vulnerability affects versions through 4.1.2 and carries a CVSS score of 9.8 (CRITICAL). The attack vector is network-based, requires no privileges and no user interaction, which means any application exposing an affected query path to request data is remotely exploitable.

The flaw lives in how Wheels escapes string literals on MySQL and MariaDB when backslash escaping is enabled (that is, when the NO_BACKSLASH_ESCAPES SQL mode is absent, which is the default on both platforms). The framework doubles single quotes to neutralize injection, but it does not account for backslash escape sequences. On these database engines a trailing backslash before a quote consumes the doubled quote, so a supplied value can break out of its string context and alter the surrounding SQL statement.

This matters because several query paths are not bound. They include opt-in parameterize=false queries and IN lists, plus positions inside developer-written where strings that the parser leaves unbound: BETWEEN bounds, function arguments, and LIKE ESCAPE literals. Any application that passes request data into one of these positions is exposed. Bound paths are unaffected, and whereBetween() has been bound since 4.1.2. If your code never uses these raw paths, you are not exposed through them.

Impact

An attacker who reaches an affected path can inject arbitrary SQL. Depending on the database account the application uses, that can mean reading sensitive tables such as credentials, session data, or customer records, modifying or deleting rows, and in some configurations escalating to file reads or broader database control. Because the flaw is unauthenticated, an attacker needs only network access to a vulnerable endpoint.

There is no evidence that this vulnerability has been exploited in the wild, but the low complexity and public proof-of-concept make weaponization trivial. Treat exposed instances as at risk until patched.

Remediation

Upgrade Wheels to 4.2.0, where the escaping logic accounts for backslash escape sequences and these paths are neutralized. This is the only complete fix.

If you cannot upgrade immediately, apply compensating controls:

• Enable NO_BACKSLASH_ESCAPES in the MySQL or MariaDB SQL mode to remove the backslash escape behavior the exploit depends on.
• Audit your application for parameterize=false queries, raw IN lists, and unbound positions in where strings (BETWEEN bounds, function arguments, LIKE ESCAPE literals).
• Move request-derived values into bound parameters or use whereBetween() where applicable.
• Restrict the database account’s privileges and review database and application logs for anomalous query patterns.

For related incident tracking, see breach reports and security news.

Security Insight

Wheels’ escaping bug is a textbook case of defensive code that models one database’s quoting rules while running against another. Doubling single quotes is correct for standard SQL string literals, but MySQL and MariaDB layer backslash escapes on top, and a fix that ignores that layer silently fails. This is the same class of gap that produced years of CMS and framework bypasses, where a mitigation valid in one engine becomes a hole in another. It reinforces a durable lesson: input escaping is not a substitute for parameter binding, and any framework that offers an opt-in raw-query path inherits the obligation to make its escaping engine-aware.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs