PT-2026-24479 · Sylius · Sylius

Neosprings · Published 2026-03-10 · Updated 2026-03-11 · CVE-2026-31825

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sylius versions 1.9.12 through 1.11.17 Sylius versions 1.12.23 through 1.13.15 Sylius versions 1.14.18 through 2.0.16 Sylius versions 2.1.12 through 2.2.3

Description Sylius is an Open Source eCommerce Framework on Symfony. The ProductPriceOrderFilter and TranslationOrderNameAndLocaleFilter API filters do not validate user-supplied order direction values before passing them to Doctrine's orderBy() function, allowing for arbitrary DQL injection. The filters pass the order direction directly to the orderBy() function without proper sanitization. This could allow an attacker to manipulate database queries.

Recommendations Update to Sylius version 1.9.12 or later. Update to Sylius version 1.10.16 or later. Update to Sylius version 1.11.17 or later. Update to Sylius version 1.12.23 or later. Update to Sylius version 1.13.15 or later. Update to Sylius version 1.14.18 or later. Update to Sylius version 2.0.16 or later. Update to Sylius version 2.1.12 or later. Update to Sylius version 2.2.3 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

CWE-943

Related Identifiers

CVE-2026-31825

GHSA-XCWX-R2GW-W93M

Affected Products

Sylius

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31825.json · Exploit
• https://github.com/Sylius/Sylius/security/advisories/GHSA-xcwx-r2gw-w93m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31825 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xcwx-r2gw-w93m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31825 · Security Note
• https://github.com/Sylius/Sylius · Note
• https://twitter.com/CVEnew/status/2031504075670372407 · Twitter Post