Arbitrary DQL Injection in Sylius eCommerce Framework
CVE-2026-31825

5.3MEDIUM

Key Information:

Vendor

Sylius

Status
Sylius
Vendor
CVE Published:
10 March 2026

What is CVE-2026-31825?

The Sylius eCommerce Framework, built on Symfony, is exposed to a security vulnerability where certain API filters, namely ProductPriceOrderFilter and TranslationOrderNameAndLocaleFilter, inadequately handle user-supplied order direction values. This oversight allows attackers to inject malicious DQL (Doctrine Query Language) commands directly into the orderBy() function used by Doctrine without proper validation. As a result, potential attackers can manipulate database queries, leading to unauthorized access or data manipulation. This issue has been addressed in several patch releases, ensuring improved security in newer versions of the product.

Affected Version(s)

Sylius >= 2.2.0, < 2.2.3 < 2.2.0, 2.2.3

Sylius >= 2.1.0, < 2.1.12 < 2.1.0, 2.1.12

Sylius >= 2.0.0, < 2.0.16 < 2.0.0, 2.0.16

References

https://github.com/Sylius/Sylius/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.