PKSA-kkj2-twt4-2665: A disabled API stays reachable through a percent-encoded path
Published Oct 22, 2026
·Updated
A disabled API stays reachable through a percent-encoded path
Affected Software
10 affected componentsFixes available
composer/sylius/sylius>=1.9.6, <1.10.0
1.10.0
composer/sylius/sylius>=1.10.1, <1.11.0
composer/sylius/sylius>=1.11.0, <1.12.0
composer/sylius/sylius>=1.12.0, <1.13.0
composer/sylius/sylius>=1.13.0, <1.14.0
composer/sylius/sylius>=1.14.0, <1.14.21
1.14.21
composer/sylius/sylius>=2.0.0, <2.1.0
composer/sylius/sylius>=2.1.0, <2.1.17
2.1.17
composer/sylius/sylius>=2.2.0, <2.2.12
2.2.12
composer/sylius/sylius>=2.3.0, <2.3.2
2.3.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/sylius/syliusto a version that resolves this vulnerability.Fixed in 1.10.0 - Upgrade
Upgrade
composer/sylius/syliusto a version that resolves this vulnerability.Fixed in 1.14.21 - Upgrade
Upgrade
composer/sylius/syliusto a version that resolves this vulnerability.Fixed in 2.1.17 - Upgrade
Upgrade
composer/sylius/syliusto a version that resolves this vulnerability.Fixed in 2.2.12 - Upgrade
Upgrade
composer/sylius/syliusto a version that resolves this vulnerability.Fixed in 2.3.2