CVE-2026-92692: Sulu CMS Information Disclosure Vulnerability

CVE-2026-92692 Overview

Sulu is an open-source PHP content management system built on the Symfony framework. A JCR-SQL2 injection vulnerability affects the Smart Content QueryBuilder component in Sulu 2.6 releases prior to 2.6.25 and 3.0 releases prior to 3.0.8. The src/Sulu/Component/Content/SmartContent/QueryBuilder.php file concatenates category identifiers from the public categories query parameter into a JCR-SQL2 WHERE clause without numeric validation. Unauthenticated attackers can manipulate query conditions on any public page that renders a category-filtered Smart Content block. The flaw is classified as Improper Neutralization of Special Elements used in an SQL Command [CWE-89].

Critical Impact
Unauthenticated attackers can enumerate content-repository nodes including unpublished content, or submit expensive query fragments that degrade site availability.

Affected Products

Sulu CMS 2.6 release line prior to 2.6.25
Sulu CMS 3.0 release line prior to 3.0.8
Symfony-based sites using Sulu Smart Content blocks with category filters

Discovery Timeline

2026-09-23 - CVE-2026-92692 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-92692

Vulnerability Analysis

The Smart Content QueryBuilder in Sulu constructs JCR-SQL2 queries used to fetch content-repository nodes for public-facing pages. Category identifiers supplied through the categories query string parameter are inserted directly into the WHERE clause. The builder does not cast or validate these values as integers before concatenation. An attacker can therefore inject additional SQL fragments that alter the boolean logic of the query.

The result is a classic injection primitive against the Jackrabbit content repository query layer. Attackers can craft payloads that flip conditions to return nodes normally filtered out, including unpublished drafts. They can also submit malformed or deliberately expensive fragments that force the repository to perform costly evaluation. This vulnerability does not permit modification of repository data.

Root Cause

The root cause is unsafe string concatenation of user-controlled input into a JCR-SQL2 statement. The affected code path builds a fragment such as page.[property] = followed by the raw identifier from the request. Because no numeric cast or allow-list is applied before concatenation, the parameter breaks out of its intended context.

Attack Vector

The attack requires only network access to a public Sulu page that renders a Smart Content block filtered by category. An unauthenticated attacker sends crafted values in the categories query parameter. The injected fragments modify the JCR-SQL2 WHERE clause to enumerate hidden nodes or trigger resource-intensive query execution.

php

// Patch excerpt from src/Sulu/Component/Content/SmartContent/QueryBuilder.php
            'excerpt'
        );

-        return 'page.[' . $property->getName() . '] = ' . $targetGroupId;
+        return 'page.[' . $property->getName() . '] = ' . (int) $targetGroupId;
    }

    private function buildSegmentKey($webspaceKey, $segmentKey, $locale)

Source: Sulu security patch commit d19c014. The fix applies an explicit (int) cast to the identifier before concatenation, forcing non-numeric input to zero and neutralizing injection attempts.

Detection Methods for CVE-2026-92692

Indicators of Compromise

Requests to public Sulu pages containing non-numeric or overly long values in the categories query parameter.
Web server log entries where categories contains SQL keywords such as OR, AND, SELECT, brackets, or comment sequences.
Anomalous response sizes on category-filtered pages that suggest inclusion of unpublished nodes.
Sudden spikes in database or Jackrabbit query latency correlated with requests targeting Smart Content pages.

Detection Strategies

Deploy web application firewall rules that reject categories parameter values not matching a strict numeric pattern.
Alert on repeated 500-series responses from routes rendering Smart Content blocks.
Correlate Sulu application logs with content-repository query logs to identify anomalous JCR-SQL2 statements.

Monitoring Recommendations

Enable verbose query logging in the Jackrabbit repository during triage to capture full JCR-SQL2 statements.
Baseline typical categories parameter cardinality per page and alert on outliers.
Track upstream response times for pages rendering Smart Content and alert on sustained degradation.

How to Mitigate CVE-2026-92692

Immediate Actions Required

Upgrade Sulu to version 2.6.25 for the 2.6 branch or 3.0.8 for the 3.0 branch as soon as possible.
Inventory public pages that render Smart Content blocks with category filters and prioritize them for patching.
Review web server access logs for suspicious categories parameter values dating back to first exposure.

Patch Information

The issue is fixed in Sulu 2.6.25 and Sulu 3.0.8. Technical details are documented in GitHub Security Advisory GHSA-jg26-q8hg-3pq4. The fix is implemented in commit d19c014, which applies an integer cast to category identifiers before use in JCR-SQL2 queries.

Workarounds

Place a WAF rule in front of Sulu that rejects requests where the categories parameter is not a comma-separated list of integers.
Temporarily remove or disable category-filtered Smart Content blocks on public pages until the patch is applied.
Restrict access to affected pages using authentication or IP allow-lists during the remediation window.

bash

# Example nginx rule to enforce numeric categories parameter
if ($arg_categories !~ "^[0-9]+(,[0-9]+)*$") {
    return 400;
}