Log in Start free

Vulnerability · Published Mar 10, 2026 · Assigned by GitHub_M

CVE-2026-31825Sylius has a DQL Injection via API Order Filters

Medium 5.3

In plain English

A medium-severity SQL injection in Sylius from Sylius. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 86.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Sylius is an Open Source eCommerce Framework on Symfony. Sylius API filters ProductPriceOrderFilter and TranslationOrderNameAndLocaleFilter pass user-supplied order direction values directly to Doctrine's orderBy() without validation. An attacker can inject arbitrary DQL. The issue is fixed in versions: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3 and above.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistsylius/sylius1.9.12GHSA-xcwx-r2gw-w93m
Packagistsylius/sylius1.10.16GHSA-xcwx-r2gw-w93m
Packagistsylius/sylius1.11.17GHSA-xcwx-r2gw-w93m
Packagistsylius/sylius1.12.23GHSA-xcwx-r2gw-w93m
Packagistsylius/sylius1.13.15GHSA-xcwx-r2gw-w93m
Packagistsylius/sylius1.14.18GHSA-xcwx-r2gw-w93m
Packagistsylius/sylius2.0.16GHSA-xcwx-r2gw-w93m
Packagistsylius/sylius2.1.12GHSA-xcwx-r2gw-w93m
Packagistsylius/sylius2.2.3GHSA-xcwx-r2gw-w93m

Affected products (as reported)

VendorProductVersions
Sylius Sylius >= 2.2.0, < 2.2.3>= 2.1.0, < 2.1.12>= 2.0.0, < 2.0.16>= 1.14.0, < 1.14.18>= 1.13.0, < 1.13.15>= 1.12.0, < 1.12.23>= 1.11.0, < 1.11.17>= 1.10.0, < 1.10.16

Weakness: CWE-89, CWE-943 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References