Media

Sylius has a DQL Injection via API Order Filters

Publicada: 11.03.2026
Actualizado: 11.10.2026 10:22

Impact

Sylius API filters ProductPriceOrderFilter and TranslationOrderNameAndLocaleFilter pass user-supplied order direction values directly to Doctrine's orderBy() without validation. An attacker can inject arbitrary DQL:

GET /api/v2/shop/products?order[price]=ASC,%20variant.code%20DESC

Patches

The issue is fixed in versions: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3 and above.

Workarounds

An EventSubscriber that sanitizes order query parameters only on API routes before they reach the vulnerable filters.

The subscriber accepts an $apiRoute constructor parameter (default /api/v2) and skips non-API requests entirely — so there is zero overhead on shop/admin page requests.

This follows the same pattern used by Sylius's own KernelRequestEventSubscriber (src/Sylius/Bundle/ApiBundle/EventSubscriber/KernelRequestEventSubscriber.php), which also uses str_contains($pathInfo, $this->apiRoute) to scope logic to API routes.

Step 1 — Create the EventSubscriber

src/EventSubscriber/SanitizeOrderDirectionSubscriber.php:

php

<?php

declare(strict_types=1);

namespace App\EventSubscriber;

use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpKernel\Event\RequestEvent;
use Symfony\Component\HttpKernel\KernelEvents;

final class SanitizeOrderDirectionSubscriber implements EventSubscriberInterface
{
    private const ALLOWED_DIRECTIONS = ['asc', 'desc'];

    public function __construct(
        private string $apiRoute,
    ) {
    }

    public static function getSubscribedEvents(): array
    {
        return [
            KernelEvents::REQUEST => ['sanitizeOrderParameters', 64],
        ];
    }

    public function sanitizeOrderParameters(RequestEvent $event): void
    {
        if (!str_contains($event->getRequest()->getPathInfo(), $this->apiRoute)) {
            return;
        }

        $request = $event->getRequest();

        /** @var mixed $order */
        $order = $request->query->all()['order'] ?? null;
        if (!is_array($order)) {
            return;
        }

        $needsSanitization = false;
        $sanitized = [];
        foreach ($order as $field => $direction) {
            if (is_string($direction) && in_array(strtolower($direction), self::ALLOWED_DIRECTIONS, true)) {
                $sanitized[$field] = $direction;
            } else {
                $needsSanitization = true;
            }
        }

        if (!$needsSanitization) {
            return;
        }

        $all = $request->query->all();
        $all['order'] = $sanitized;
        $request->query->replace($all);

        $request->server->set('QUERY_STRING', http_build_query($all));
        $request->attributes->set('_api_filters', $all);
    }
}

Step 2 — Register the service

Option A — If your config/services.yaml already has App\ autowiring (Symfony default):

yaml

# Nothing to do — autoconfigure picks up EventSubscriberInterface automatically.
# Optionally bind the API route prefix:
services:
    App\EventSubscriber\SanitizeOrderDirectionSubscriber:
        arguments:
            $apiRoute: '%sylius.security.new_api_route%'

Option B — If there is no App\ autowiring:

yaml

services:
    App\EventSubscriber\SanitizeOrderDirectionSubscriber:
        arguments:
            $apiRoute: '%sylius.security.new_api_route%'
        tags: ['kernel.event_subscriber']

Using %sylius.security.new_api_route% ties the subscriber to the same prefix Sylius uses (/api/v2 by default). If the parameter is not available, hardcode '/api/v2' instead.

Step 3 — Clear cache

bash

bin/console cache:clear

Reporters

We would like to extend our gratitude to the following individuals for their detailed reporting and responsible disclosure of this vulnerability:

Chris Alupului (@Neosprings)
Bartłomiej Nowiński (@bnBart)

For more information

If you have any questions or comments about this advisory:

Open an issue in Sylius issues
Email us at security@sylius.com

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Paquete de Composer	sylius/sylius	< 1.9.12, >= 1.10.0, < 1.10.16, >= 1.11.0, < 1.11.17, >= 1.12.0, < 1.12.23, >= 1.13.0, < 1.13.15, >= 1.14.0, < 1.14.18, >= 2.0.0, < 2.0.16, >= 2.1.0, < 2.1.12, >= 2.2.0, < 2.2.3	1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3

Referencias

Puntuación CVSS 5.3/10

Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Debilidad (CWE): CWE-89, CWE-943
Plataforma: Composer
Paquete: sylius/sylius
Publicada: 11.03.2026
Actualizado: 11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-xcwx-r2gw-w93m - CC BY 4.0

Historial de vulnerabilidades: sylius/sylius

Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (23) en el archivo

Entradas en total: 23
Primera → última: 12.2019 07.2026
Sin corrección: 0
Explotada en ataques: 0

Distribución por gravedad

Alta 4
Media 17
Baja 2

Divulgaciones por año

2019: 1
2020: 3
2021: 1
2022: 4
2023: 0
2024: 4
2025: 0
2026: 10

11.03.2026

Sylius has a DQL Injection via API Order Filters esta entrada

Media · 5.3 CVE-2026-31825 < 1.9.12, >= 1.10.0, < 1.10.16, >= 1.11.0, < 1.11.17, >= 1.12.0, < 1.12.23, >= 1.13.0, < 1.13.15, >= 1.14.0, < 1.14.18, >= 2.0.0, < 2.0.16, >= 2.1.0, < 2.1.12, >= 2.2.0, < 2.2.3 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3
11.03.2026

Sylius has a Promotion Usage Limit Bypass via Race Condition

Alta · 8.2 CVE-2026-31824 < 1.9.12, >= 1.10.0, < 1.10.16, >= 1.11.0, < 1.11.17, >= 1.12.0, < 1.12.23, >= 1.13.0, < 1.13.15, >= 1.14.0, < 1.14.18, >= 2.0.0, < 2.0.16, >= 2.1.0, < 2.1.12, >= 2.2.0, < 2.2.3 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3
11.03.2026

Sylius affected by IDOR in Cart and Checkout LiveComponents

Alta CVE-2026-31820 >= 2.0.0, < 2.0.16, >= 2.1.0, < 2.1.12, >= 2.2.0, < 2.2.3 2.0.16, 2.1.12, 2.2.3
17.07.2024

Sylius has a security vulnerability via adjustments API endpoint

Alta · 7.5 CVE-2024-40633 >= 1.12.0-alpha.1, < 1.12.19, >= 1.13.0-alpha.1, < 1.13.4, < 1.9.12, >= 1.10.0-alpha.1, < 1.10.16, >= 1.11.0-alpha.1, < 1.11.17 1.12.19, 1.13.4, 1.9.12, 1.10.16, 1.11.17
14.03.2022

Insufficient Session Expiration in Sylius

Alta · 7.1 CVE-2022-24743 >= 1.10.0, < 1.10.11, >= 1.11.0, < 1.11.2 1.10.11, 1.11.2

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación