PT-2026-24479 · Sylius · Sylius

Neosprings · Publicado 2026-03-10 · Atualizado 2026-03-11 · CVE-2026-31825

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sylius versions 1.9.12 through 1.11.17 Sylius versions 1.12.23 through 1.13.15 Sylius versions 1.14.18 through 2.0.16 Sylius versions 2.1.12 through 2.2.3

Description Sylius is an Open Source eCommerce Framework on Symfony. The ProductPriceOrderFilter and TranslationOrderNameAndLocaleFilter API filters do not validate user-supplied order direction values before passing them to Doctrine's orderBy() function, allowing for arbitrary DQL injection. The filters pass the order direction directly to the orderBy() function without proper sanitization. This could allow an attacker to manipulate database queries.

Recommendations Update to Sylius version 1.9.12 or later. Update to Sylius version 1.10.16 or later. Update to Sylius version 1.11.17 or later. Update to Sylius version 1.12.23 or later. Update to Sylius version 1.13.15 or later. Update to Sylius version 1.14.18 or later. Update to Sylius version 2.0.16 or later. Update to Sylius version 2.1.12 or later. Update to Sylius version 2.2.3 or later.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

CWE-943

Identificadores relacionados

CVE-2026-31825

GHSA-XCWX-R2GW-W93M

Produtos afetados

Sylius

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31825.json · Exploit
• https://github.com/Sylius/Sylius · Nota
• https://github.com/Sylius/Sylius/security/advisories/GHSA-xcwx-r2gw-w93m · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-31825 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-xcwx-r2gw-w93m · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-31825 · Nota de Segurança
• https://twitter.com/CVEnew/status/2031504075670372407 · Publicação no Twitter