AIKIDO-2026-620626

TL;DR

The QueriesJsonColumns trait builds the SQL ORDER BY clause for JSON cast entry and asset fields using a caller supplied sort direction without validating it. An authenticated Control Panel user with access to a collection or asset container can pass a direction such as asc, (select 1) to inject SQL into the ordering clause and read arbitrary database data, including user records and password hashes. The fix adds an allowlist that only accepts asc or desc and throws an exception for anything else.