{"id":"GHSA-jg26-q8hg-3pq4","summary":"Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)","details":"### Impact\n\nAn unauthenticated JCR-SQL2 injection exists in the Smart Content category filter of the 2.x content query builder.\n\nCategory IDs supplied through the public `?categories=` query parameter are only trimmed and are then concatenated directly into a JCR-SQL2 `WHERE` clause, without the numeric validation that the equivalent tag filter already performs. Any public page that renders a Smart Content element with category filtering enabled evaluates this parameter, so no authentication or special configuration beyond a category-filtered content block is required.\n\nAn anonymous visitor can therefore:\n\n- inject boolean conditions to infer the existence of, and disclose, content nodes they should not see (for example unpublished pages) via blind boolean-based extraction; and\n- submit malformed query fragments that cause query errors or resource-intensive queries, degrading availability.\n\nBecause the sink is a JCR-SQL2 query, the impact is limited to reading and enumerating content-repository nodes and to error/denial-of-service conditions; it cannot be used to modify data through this path.\n\n### Patches\n\nFixed in **2.6.25 and 3.0.8**. Category, tag, and audience-target-group IDs are now cast to integers before they are used in the JCR-SQL2 query, so no attacker-controlled characters can reach the query.\n\n### Workarounds\n\nIf you cannot upgrade immediately:\n\n- Apply the fix manually — cast each ID to an integer where it is concatenated into the category (and, defensively, tag and audience-targeting) `WHERE` clause in the content Smart Content query builder.\n- Alternatively, disable category filtering on publicly reachable Smart Content elements until the patch is applied.","aliases":["CVE-2026-92692"],"modified":"2026-09-23T18:30:05.673569743Z","published":"2026-09-23T18:21:22Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-09-23T18:21:22Z","nvd_published_at":null,"cwe_ids":["CWE-89"]},"references":[{"type":"WEB","url":"https://github.com/sulu/sulu/security/advisories/GHSA-jg26-q8hg-3pq4"},{"type":"WEB","url":"https://github.com/sulu/sulu/commit/d19c01487af8c3de2fb3aa145856707a6367392c"},{"type":"PACKAGE","url":"https://github.com/sulu/sulu"},{"type":"WEB","url":"https://github.com/sulu/sulu/releases/tag/2.6.25"},{"type":"WEB","url":"https://github.com/sulu/sulu/releases/tag/3.0.8"}],"affected":[{"package":{"name":"sulu/sulu","ecosystem":"Packagist","purl":"pkg:composer/sulu/sulu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.25"}]}],"versions":["0.1.0","0.1.1","0.10.0","0.10.1","0.10.2","0.11.0","0.11.1","0.11.2","0.12.0","0.13.0","0.13.1","0.13.2","0.14.0","0.14.1","0.14.2","0.15.0","0.15.1","0.15.2","0.15.3","0.16.0","0.16.1","0.16.2","0.17.0","0.17.0-RC1","0.17.0-RC2","0.18.0","0.18.1","0.18.2","0.2.0","0.3.0","0.4.0","0.5.0","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.6.6","0.6.7","0.6.8","0.7.0","0.7.1","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.9.0","1.0.0","1.0.0-RC1","1.0.0-RC2","1.0.0-RC3","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.1.0-RC1","1.1.0-RC2","1.1.0-beta1","1.1.1","1.1.10","1.1.11","1.1.12","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9","1.2.0","1.2.0-RC1","1.2.0-RC2","1.2.0-RC3","1.2.0-RC4","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","1.3.0","1.3.0-RC1","1.3.0-RC2","1.3.0-RC3","1.3.1","1.3.10","1.3.11","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9","1.4.0","1.4.0-RC1","1.4.0-RC2","1.4.1","1.4.10","1.4.11","1.4.12","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9","1.5.0","1.5.0-RC1","1.5.0-RC2","1.5.0-RC3","1.5.1","1.5.10","1.5.11","1.5.12","1.5.13","1.5.14","1.5.15","1.5.16","1.5.17","1.5.18","1.5.19","1.5.2","1.5.20","1.5.21","1.5.22","1.5.23","1.5.24","1.5.3","1.5.4","1.5.5","1.5.6","1.5.7","1.5.8","1.5.9","1.6.0","1.6.0-RC1","1.6.1","1.6.10","1.6.11","1.6.12","1.6.13","1.6.14","1.6.15","1.6.16","1.6.17","1.6.18","1.6.19","1.6.2","1.6.20","1.6.21","1.6.22","1.6.23","1.6.24","1.6.25","1.6.26","1.6.27","1.6.28","1.6.29","1.6.3","1.6.30","1.6.31","1.6.32","1.6.33","1.6.34","1.6.35","1.6.36","1.6.37","1.6.38","1.6.39","1.6.4","1.6.40","1.6.41","1.6.42","1.6.43","1.6.44","1.6.45","1.6.46","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9","2.0.0","2.0.0-RC1","2.0.0-RC2","2.0.0-RC3","2.0.0-alpha1","2.0.0-alpha2","2.0.0-alpha3","2.0.0-alpha4","2.0.0-alpha5","2.0.0-alpha6","2.0.1","2.0.10","2.0.11","2.0.12","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0","2.1.0-RC1","2.1.0-RC2","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.0-RC1","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.16","2.2.17","2.2.18","2.2.19","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.3.0","2.3.0-RC1","2.3.0-RC2","2.3.1","2.3.10","2.3.11","2.3.12","2.3.13","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.0-RC1","2.4.1","2.4.10","2.4.11","2.4.12","2.4.13","2.4.14","2.4.15","2.4.16","2.4.17","2.4.18","2.4.19","2.4.2","2.4.20","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9","2.5.0","2.5.0-alpha1","2.5.1","2.5.10","2.5.11","2.5.12","2.5.13","2.5.14","2.5.15","2.5.16","2.5.17","2.5.18","2.5.19","2.5.2","2.5.20","2.5.21","2.5.22","2.5.23","2.5.24","2.5.25","2.5.26","2.5.27","2.5.28","2.5.29","2.5.3","2.5.30","2.5.31","2.5.32","2.5.33","2.5.4","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9","2.6.0","2.6.0-RC1","2.6.0-RC2","2.6.1","2.6.10","2.6.11","2.6.12","2.6.13","2.6.14","2.6.15","2.6.16","2.6.17","2.6.18","2.6.19","2.6.2","2.6.20","2.6.21","2.6.22","2.6.23","2.6.24","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-jg26-q8hg-3pq4/GHSA-jg26-q8hg-3pq4.json"}},{"package":{"name":"sulu/sulu","ecosystem":"Packagist","purl":"pkg:composer/sulu/sulu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.8"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-jg26-q8hg-3pq4/GHSA-jg26-q8hg-3pq4.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N"}]}