CVE-2026-92692

Executive Summary

CVE-2026-92692 is a SQL injection vulnerability (CWE-89) in Sulu, an open-source PHP content management system built on the Symfony framework. The flaw exists in the Smart Content QueryBuilder component, which concatenates category identifiers from the public categories query parameter into a JCR-SQL2 WHERE clause without numeric validation. Unauthenticated attackers who can reach a public page containing a category-filtered Smart Content block may alter query conditions to infer or enumerate content-repository nodes — including unpublished content — or submit malformed and expensive query fragments that degrade availability. The affected release lines are Sulu 2.6 prior to 2.6.25 and Sulu 3.0 prior to 3.0.8.

Technical Analysis

The vulnerability resides in the file src/Sulu/Component/Content/SmartContent/QueryBuilder.php, which is part of Sulu's Smart Content subsystem. Smart Content blocks are a native Sulu feature that allows editors to embed dynamically queried content lists (for example, "all articles assigned category X") into pages. According to the NVD description, the QueryBuilder within this component builds a JCR-SQL2 WHERE clause by directly concatenating category identifiers supplied through the public categories query parameter, without applying numeric validation to those values.

Because the category values are interpolated into a JCR-SQL2 query string rather than bound as parameters, an attacker can influence the structure of the generated query rather than merely supplying a category number. The practical consequences described by the maintainers are threefold:

1. Content inference and enumeration — manipulated query conditions allow an attacker to infer or enumerate content-repository nodes that would not normally be returned, explicitly including unpublished content. This is a confidentiality issue: unpublished nodes represent editorial work-in-progress, embargoed material, or staging content that the CMS operator intended to keep private.
2. Availability degradation — malformed or deliberately expensive query fragments can be submitted, placing load on the JCR content repository and degrading service availability for legitimate users.
3. No data modification — the advisory explicitly states this path does not modify repository data. There is no write primitive described, so integrity of stored content is not directly at risk through this vector.

The attack surface is the public-facing front end: exploitation requires only that a page exposed to unauthenticated visitors contains a category-filtered Smart Content block. No administrative access, no authenticated session, and no user interaction beyond issuing an HTTP request with a crafted query string are required. The entry point is a GET-style parameter, making the attack trivially scriptable and easy to blend into ordinary web traffic.

The underlying defect class is classic string-concatenation query construction — the same root cause pattern that yields SQL injection in conventional SQL contexts, here applied to JCR-SQL2, the query language used by Java Content Repository implementations. JCR-SQL2 supports filtering, comparison, and function expressions; permitting attacker-controlled text to enter the WHERE clause enables condition manipulation and, depending on the repository engine, potentially expensive recursive or wildcard queries.

It is important to note the limits of the available information: the NVD description does not identify specific JCR-SQL2 operators, repository backend, or parameterization alternatives used in the fix. This report therefore confines itself to the mechanism named in the advisory and does not speculate about additional injection points or payload constructions beyond the class-level behavior described.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is known to exist for CVE-2026-92692 at the time of writing. The attack chain below is inferred from the vulnerability class (CWE-89, JCR-SQL2 injection via concatenated parameter) and the description provided.

1) Reconnaissance and target identification. An attacker enumerates internet-facing Sulu deployments. Fingerprinting relies on the CMS's characteristic front-end markup, its administrative login path (/admin/login, a Sulu default), and responses that reference the Sulu framework. The attacker then probes for pages whose content includes a category-filtered Smart Content block — typically section, blog, or news listing pages where the URL or query string accepts a categories parameter.

2) Triggering the flaw class. The attacker issues a request to such a page with a manipulated categories parameter. Because the value is concatenated directly into the JCR-SQL2 WHERE clause without numeric validation, the attacker can alter the logical structure of the query — changing filter conditions so that nodes outside the intended category (or outside the published set) are matched and rendered.

3) Payload and execution method. At the vulnerability-class level, the payload consists of crafted query fragments embedded in the categories parameter. These fragments modify boolean conditions to broaden result sets (used to infer the existence of nodes and enumerate unpublished content) or introduce malformed and computationally expensive query constructs (used to consume repository resources and degrade availability). No authentication is required; the malicious request is indistinguishable at the transport layer from a legitimate search or category filter.

4) Post-exploitation impact. Successful exploitation yields information disclosure about the content repository — a map of node identifiers, categories, and unpublished content that may contain sensitive pre-release information, internal notes, or embargoed material. Combined with other weaknesses, this reconnaissance value could support more targeted attacks. The availability variant produces resource-exhaustion symptoms on the repository layer, affecting all site visitors. Critically, the described exploit path does not modify repository data, so no content tampering or privilege escalation is attributed to this CVE in the available intelligence.

Impact Assessment

The vulnerability carries a CVSS v3.1 base vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L in this assessment. The reasoning: the attack is network-reachable (AV:N); it requires no special conditions or privileges (AC:L, PR:N) and no user interaction (UI:N); the scope remains within the vulnerable component (S:U). Confidentiality impact is high (C:H) because unpublished repository content can be inferred and enumerated; availability impact is low-to-moderate (A:L) because expensive query fragments can stress the content repository without, on the evidence available, causing guaranteed full outage. Integrity impact is none (I:N), consistent with the advisory's explicit statement that this path does not modify repository data.

Note on scoring: No CVSS score or vector was supplied in the source intelligence for this CVE. The vector above is an analytical estimate based solely on the NVD description and should be treated as provisional until the vendor or NVD publishes an official score.

Business impact centers on content confidentiality and operational stability. Organizations using Sulu to manage publishing workflows may have unpublished, embargoed, or draft content resident in the same JCR repository served by public pages. Leakage of that content can undermine editorial embargoes, reveal business plans, or expose internal materials. The availability dimension matters for high-traffic public sites where a single unauthenticated request pattern can be parallelized to degrade performance for all users. Blast radius is bounded by the deployment's public exposure: any Sulu 2.6 (< 2.6.25) or 3.0 (< 3.0.8) instance with a category-filtered Smart Content block on a public page is potentially affected.

Detection Guidance

Sigma Rule

title: Sulu Smart Content categories Parameter JCR-SQL2 Injection Attempt
id: 6f3a2c1e-9b47-4d2a-8c5e-1a7f9d3b6e42
status: experimental
description: Detects HTTP requests to Sulu front-end pages with suspicious JCR-SQL2 metacharacters
  or boolean/timing constructs in the public categories query parameter, indicative of
  CVE-2026-92692 exploitation attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92692
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection_param:
    cs-uri-query|contains: 'categories='
  selection_payload:
    cs-uri-query|contains:
      - "'"
      - '"'
      - ' OR '
      - ' AND '
      - 'UNION'
      - 'SELECT'
      - '--'
      - '/*'
      - '%27'
      - '%22'
      - 'xp_'
      - 'WAITFOR'
      - 'SLEEP'
      - 'BENCHMARK'
  condition: selection_param and selection_payload
fields:
  - c-ip
  - cs-uri
  - cs-uri-query
  - cs-method
  - sc-status
falsepositives:
  - Legitimate category names containing apostrophes in rare locales
  - Search-engine crawlers replaying crafted URLs
level: high

YARA Rule

rule CVE_2026_92692_Sulu_SmartContent_JCRSQL2_Injection
{
    meta:
        description = "Detects exploitation attempts against Sulu Smart Content QueryBuilder JCR-SQL2 injection (CVE-2026-92692) in HTTP access logs or request captures"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92692"
        date = "2026-01-01"
        severity = "high"

    strings:
        $param = "categories=" ascii nocase wide
        $q1 = "' OR " ascii nocase wide
        $q2 = "' AND " ascii nocase wide
        $q3 = "UNION SELECT" ascii nocase wide
        $q4 = "WAITFOR DELAY" ascii nocase wide
        $q5 = "BENCHMARK(" ascii nocase wide
        $q6 = "SLEEP(" ascii nocase wide
        $q7 = "/*" ascii wide
        $q8 = "--" ascii wide
        $smart = "SmartContent" ascii wide

    condition:
        $param and 2 of ($q*) or ($param and $smart and any of ($q*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92692 Sulu Smart Content JCR-SQL2 Injection Attempt in categories Parameter"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"categories="; nocase; http.uri; content:"%27"; nocase; pcre:"/categories=[^&]*(%27|'|\x22|%22|UNION|SELECT|WAITFOR|SLEEP|BENCHMARK|--|\/\*)/Ui"; classtype:web-application-attack; reference:cve,2026-92692; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-92692; sid:202692692; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ url.query : "categories=*" ]
  [ url.query : ("*%27*" or "*UNION*" or "*SELECT*" or "*WAITFOR*" or "*SLEEP(*" or "*BENCHMARK(*") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access OR sourcetype=apache:access
| eval uri_query = coalesce(uri_query, cs_uri_query, " ")
| where match(lower(uri_query), "categories=")
| where match(uri_query, "(?i)(%27|'|\x22|%22|UNION|SELECT|WAITFOR|SLEEP\s*\(|BENCHMARK\s*\(|--|/\*)")
| rex field=uri_query "categories=(?<category_val>[^&]+)"
| stats count values(uri) as urls dc(uri) as unique_urls by clientip
| where count >= 3
| sort - count
| table clientip, count, unique_urls, urls

Wazuh OSSEC Rule

<group name="web,appsec,sulu,">
  <rule id="2026921" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>categories=</url>
    <regex type="pcre2">(?i)categories=[^&\s]*(%27|'|UNION|SELECT|WAITFOR|SLEEP\s*\(|BENCHMARK\s*\(|--|/\*)</regex>
    <description>CVE-2026-92692: Possible Sulu Smart Content JCR-SQL2 injection attempt in categories parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sql_injection,web_attack,</group>
  </rule>

  <rule id="2026922" level="12" frequency="5" timeframe="120">
    <if_matched_sid>2026921</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-92692: Repeated Sulu JCR-SQL2 injection attempts from same source (possible automated scanning)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sql_injection,web_attack,scanning,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED) — a single source (a GitHub Security Advisory) states that versions 2.6.25 and 3.0.8 resolve the issue, and this has not been independently confirmed. Treat the fix as likely but verify against the actual release artifacts before relying solely on the version number.

1) Immediate mitigations (apply while patch validation is pending):

• Restrict or remove public pages that contain category-filtered Smart Content blocks until the patch can be applied, if the business permits.
• Deploy a web application firewall (WAF) or reverse-proxy rule that rejects requests whose categories parameter contains non-numeric characters or JCR-SQL2 metacharacters. The parameter is expected to be a numeric category identifier, so enforcing a strict numeric allowlist is both safe and effective.
• Rate-limit unauthenticated requests to Smart Content endpoints to blunt the availability-degradation variant.
• Ensure unpublished content and staging nodes are not co-resident in repositories reachable by public front-end queries, reducing the confidentiality exposure.

2) Patch/upgrade steps:

• Upgrade Sulu 2.6 release-line instances to 2.6.25 or later.
• Upgrade Sulu 3.0 release-line instances to 3.0.8 or later.
• Rebuild and redeploy any container images pinned to vulnerable versions.
• Verify the fix by confirming that the categories parameter is validated as numeric before being incorporated into the JCR-SQL2 WHERE clause, per the advisory's description of the corrected behavior.

3) Long-term hardening:

• Replace string concatenation with parameterized or typed query construction in all JCR-SQL2 query paths, and audit the Smart Content subsystem and similar components for the same pattern.
• Add unit and integration tests that assert non-numeric and metacharacter-laden categories inputs are rejected or safely coerced.
• Institute a routine dependency-monitoring workflow (e.g., subscribe to Sulu security advisories and GitHub Security Advisories) to catch future CVEs in the CMS and its Symfony dependencies.
• Apply least-privilege to the CMS service account used for repository access so that even a successful injection cannot reach data beyond what the front end legitimately serves.

References

• NVD — CVE-2026-92692: https://nvd.nist.gov/vuln/detail/CVE-2026-92692
• Sulu project security advisories (GitHub Security Advisory / GHSA): https://github.com/sulu/sulu/security/advisories
• MITRE CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection"): https://cwe.mitre.org/data/definitions/89.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (verify current status; CVE-2026-92692 is not listed as exploited at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

At present there is no evidence of exploit-in-the-wild activity, no public proof-of-concept, no Nuclei template, and no named threat-actor campaign associated with CVE-2026-92692. This assessment should be revisited if exploitation artifacts surface.