CVE-2026-31825
Received
Received - Intake
DQL Injection in Sylius API Order Filters Enables Data Manipulation
Publication date: 2026-03-10
Last updated on: 2026-03-18
Assigner: GitHub, Inc.
Description
Description
Sylius is an Open Source eCommerce Framework on Symfony. Sylius API filters ProductPriceOrderFilter and TranslationOrderNameAndLocaleFilter pass user-supplied order direction values directly to Doctrine's orderBy() without validation. An attacker can inject arbitrary DQL. The issue is fixed in versions: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3 and above.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sylius | sylius | to 1.9.12 (exc) |
| sylius | sylius | From 1.10.0 (inc) to 1.10.16 (exc) |
| sylius | sylius | From 1.11.0 (inc) to 1.11.17 (exc) |
| sylius | sylius | From 1.12.0 (inc) to 1.12.23 (exc) |
| sylius | sylius | From 1.13.0 (inc) to 1.13.15 (exc) |
| sylius | sylius | From 1.14.0 (inc) to 1.14.18 (exc) |
| sylius | sylius | From 2.0.0 (inc) to 2.0.16 (exc) |
| sylius | sylius | From 2.1.0 (inc) to 2.1.12 (exc) |
| sylius | sylius | From 2.2.0 (inc) to 2.2.3 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-943 | The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. |
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
