Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)

Medium

### Impact An unauthenticated JCR-SQL2 injection exists in the Smart Content category filter of the 2.x content query builder. Category IDs supplied through the public `?categories=` query parameter are only trimmed and are then concatenated directly into a JCR-SQL2 `WHERE` clause, without the numeric validation that the equivalent tag filter already performs. Any public page that renders a Smart Content element with category filtering enabled evaluates this parameter, so no authentication or special configuration beyond a category-filtered content block is required.

Remediation

Upgrade sulu/sulu to 2.6.25 or later. Upgrade sulu/sulu to 3.0.8 or later.

Affected PHP branches

See the source advisory.

Check your site

Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-jg26-q8hg-3pq4

← All threats