CVE-2026-31825

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-31825
Sylius is an Open Source eCommerce Framework on Symfony. Sylius API filters ProductPriceOrderFilter and TranslationOrderNameAndLocaleFilter pass user-supplied order direction values directly to Doctrine's orderBy() without validation. An attacker can inject arbitrary DQL. The issue is fixed in versions: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3 and above.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/Sylius/Sylius/security/advisories/GHSA-xcwx-r2gw-w93m Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*
cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*
cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*
cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*
cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*
cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*
cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*
cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*
cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*
History

18 Mar 2026, 19:48

Type Values Removed Values Added
CPE cpe:2.3:a:sylius:sylius:*:*:*:*:*:*:*:*
First Time Sylius
Sylius sylius
References () https://github.com/Sylius/Sylius/security/advisories/GHSA-xcwx-r2gw-w93m - () https://github.com/Sylius/Sylius/security/advisories/GHSA-xcwx-r2gw-w93m - Mitigation, Vendor Advisory

11 Mar 2026, 13:52

Type Values Removed Values Added
Summary
  • (es) Sylius es un framework de eCommerce de código abierto en Symfony. Los filtros de la API de Sylius ProductPriceOrderFilter y TranslationOrderNameAndLocaleFilter pasan valores de dirección de orden suministrados por el usuario directamente a orderBy() de Doctrine sin validación. Un atacante puede inyectar DQL arbitrario. El problema está solucionado en las versiones: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3 y superiores.

10 Mar 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-10 22:16

Updated : 2026-03-18 19:48

NVD link : CVE-2026-31825

Mitre link : CVE-2026-31825

CVE.ORG link : CVE-2026-31825

JSON object : View

Products Affected

sylius

  • sylius
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CWE-943

Improper Neutralization of Special Elements in Data Query Logic