CVE-2026-92692: Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)
Impact
An unauthenticated JCR-SQL2 injection exists in the Smart Content category filter of the 2.x content query builder.
Category IDs supplied through the public ?categories= query parameter are only trimmed and are then concatenated directly into a JCR-SQL2 WHERE clause, without the numeric validation that the equivalent tag filter already performs. Any public page that renders a Smart Content element with category filtering enabled evaluates this parameter, so no authentication or special configuration beyond a category-filtered content block is required.
An anonymous visitor can therefore:
- inject boolean conditions to infer the existence of, and disclose, content nodes they should not see (for example unpublished pages) via blind boolean-based extraction; and - submit malformed query fragments that cause query errors or resource-intensive queries, degrading availability.
Because the sink is a JCR-SQL2 query, the impact is limited to reading and enumerating content-repository nodes and to error/denial-of-service conditions; it cannot be used to modify data through this path.
Patches
Fixed in 2.6.25 and 3.0.8. Category, tag, and audience-target-group IDs are now cast to integers before they are used in the JCR-SQL2 query, so no attacker-controlled characters can reach the query.
Workarounds
If you cannot upgrade immediately:
- Apply the fix manually — cast each ID to an integer where it is concatenated into the category (and, defensively, tag and audience-targeting) WHERE clause in the content Smart Content query builder. - Alternatively, disable category filtering on publicly reachable Smart Content elements until the patch is applied.
Other sources
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the public categories query parameter into a JCR-SQL2 WHERE clause without numeric validation. On a public page containing a category-filtered Smart Content block, an unauthenticated attacker can alter query conditions to infer or enumerate content-repository nodes, including unpublished content, or submit malformed and expensive query fragments that degrade availability; this path does not modify repository data. This issue is fixed in versions 2.6.25 and 3.0.8.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/sulu/suluto a version that resolves this vulnerability.Fixed in 3.0.8 - Upgrade
Upgrade
composer/sulu/suluto a version that resolves this vulnerability.Fixed in 2.6.25 - Upgrade
Upgrade
Suluto a version that resolves this vulnerability.Fixed in 2.6.25 - Upgrade
Upgrade
Suluto a version that resolves this vulnerability.Fixed in 3.0.8 - Configuration
Disable category filtering on publicly reachable Smart Content elements until the patch is applied.
Smart Content elements category filtering = disabled - Compensating control
In the Smart Content query builder, cast category, tag, and audience-target-group IDs to integers before concatenating them into the JCR-SQL2 WHERE clause.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed if they run an affected Sulu 2.x content query builder and have a public page rendering a Smart Content element with category filtering enabled. No authentication is required for exploitation.
What can an attacker do through the vulnerable parameter?
An anonymous attacker can inject boolean conditions through the categories parameter to infer and disclose content-repository nodes, including potentially unpublished pages, using blind boolean-based extraction. They can also submit malformed or resource-intensive query fragments that produce errors or degrade availability; this path cannot modify data.
What versions contain fixes?
The issue is fixed in Sulu 2.6.25 and 3.0.8.
What should be prioritized if an immediate upgrade is not possible?
Prioritize identifying public pages that render Smart Content elements with category filtering enabled, because those pages evaluate the categories query parameter. Restricting public access to those pages removes anonymous access to the vulnerable query path.