CVE-2026-92692 Details

A JCR-SQL2 injection vulnerability has been identified in the Smart Content QueryBuilder of Sulu, an open-source PHP content management system. This issue affects Sulu versions 2.6.24 and prior to 3.0.8. The vulnerability arises because category identifiers from the public 'categories' query parameter are concatenated into a JCR-SQL2 WHERE clause without proper numeric validation. An unauthenticated attacker can exploit this flaw on public pages with category-filtered Smart Content blocks, allowing them to manipulate query conditions. This could lead to unauthorized access to content repository nodes, including unpublished material, or cause denial-of-service conditions by submitting resource-intensive query fragments. However, this vulnerability does not allow for direct modification of repository data.

Users can upgrade to Sulu versions 2.6.25 or 3.0.8, where this vulnerability has been patched. In version 2.6.25, category, tag, and audience-target-group IDs are now validated before being used in JCR-SQL2 queries. Alternatively, if an immediate upgrade is not possible, the vulnerability can be manually addressed by casting each category ID to an integer before it is added to the JCR-SQL2 WHERE clause. As a temporary measure, category filtering can be disabled on public Smart Content elements until the patch is applied.