Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-92692

Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)

CVSS 4.0 6.9 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-92692

Published

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the public categories query parameter into a JCR-SQL2 WHERE clause without numeric validation. On a public page containing a category-filtered Smart Content block, an unauthenticated attacker can alter query conditions to infer or enumerate content-repository nodes, including unpublished content, or submit malformed and expensive query fragments that degrade availability; this path does not modify repository data. This issue is fixed in versions 2.6.25 and 3.0.8.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-92692

Published

sulu

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "sulu",
                    "product": "sulu",
                    "versions": [
                        {
                            "version": "< 2.6.25",
                            "status": "affected"
                        },
                        {
                            "version": ">= 3.0.0, < 3.0.8",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON