SQL Injection in sulu/sulu (CVE-2026-92692)
Summary
SQL injection in sulu/sulu (CVE-2026-92692). Risk of unauthorized operations or information disclosure. Exploitable via WHERE. Mitigation: upgrade to 3.0.8 or later.
Original description
The description as published by the source.
Impact
An unauthenticated JCR-SQL2 injection exists in the Smart Content category filter of the 2.x content query builder.
Category IDs supplied through the public ?categories= query parameter are only trimmed and are then concatenated directly into a JCR-SQL2 WHERE clause, without the numeric validation that the equivalent tag filter already performs. Any public page that renders a Smart Content element with category filtering enabled evaluates this parameter, so no authentication or special configuration beyond a category-filtered content block is required.
An anonymous visitor can therefore:
- inject boolean conditions to infer the existence of, and disclose, content nodes they should not see (for example unpublished pages) via blind boolean-based extraction; and
- submit malformed query fragments that cause query errors or resource-intensive queries, degrading availability.
Because the sink is a JCR-SQL2 query, the impact is limited to reading and enumerating content-repository nodes and to error/denial-of-service conditions; it cannot be used to modify data through this path.
Patches
Fixed in 2.6.25 and 3.0.8. Category, tag, and audience-target-group IDs are now cast to integers before they are used in the JCR-SQL2 query, so no attacker-controlled characters can reach the query.
Workarounds
If you cannot upgrade immediately:
- Apply the fix manually — cast each ID to an integer where it is concatenated into the category (and, defensively, ta…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-92692 has been found in sulu/sulu.
Attackers can target a specific entry point like WHERE over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade sulu/sulu to 3.0.8 or later.
If unsure, ask your IT team or search "sulu/sulu CVE-2026-92692" on the vendor's site.
CVE-2026-92692 (sulu/sulu) — CWE-89
Attack surface: WHERE
Patched: 3.0.8 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
SQL injection (CWE-89) exists in sulu/sulu. Attackers reach the vulnerable code path via WHERE.
Check the vendor advisory for the affected versions of sulu/sulu. Attack surface: WHERE.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to 3.0.8.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'sulu/sulu' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'sulu/sulu' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
sulu/suluを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade sulu/sulu to 3.0.8ステージング環境で 3.0.8 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com