Sulu CMS CVE-2026-92692

Exploitation requires a publicly reachable Sulu page that renders a Smart Content element with category filtering enabled - this is the specific feature that evaluates the vulnerable ?categories= parameter in QueryBuilder::buildCategoriesWhere(). No authentication and no special configuration beyond that block are needed (PR:N, UI:N), so any anonymous visitor can reach it. The limiting factor is deployment-specific: sites that do not expose category-filtered Smart Content publicly are not exploitable via this path, and the impact is confined to reading/enumerating content-repository nodes and causing query errors/DoS - it cannot modify repository data. Affected versions are Sulu < 2.6.25 and >= 3.0.0, < 3.0.8.

The CVSS 4.0 score of 6.9 (MEDIUM) is credible and, if anything, slightly generous. The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N with VC:L/VI:N/VA:L accurately reflects an unauthenticated, network-reachable flaw with low confidentiality and low availability impact and no integrity impact - the GHSA advisory explicitly states this JCR-SQL2 sink 'cannot be used to modify data.' No EPSS score, no CISA KEV listing, and no weaponized public exploit are present in the input (the fix commit ships only unit tests demonstrating that injection payloads are neutralized, which is not an attacker-ready POC). The real-world risk is therefore GATED, not universal: exploitation requires that a publicly reachable page actually render a Smart Content block with category filtering enabled - many Sulu deployments may not expose such a block. The dominant realistic impact is blind boolean-based enumeration of content-repository nodes to disclose unpublished pages, plus expensive/malformed queries causing degradation; neither yields RCE or data modification. This is a legitimate but moderate priority: patch on a normal cycle, prioritizing instances confirmed to expose category-filtered Smart Content.

An anonymous visitor finds a public Sulu page rendering a category-filtered Smart Content block and manipulates the ?categories= query parameter, injecting boolean conditions that are concatenated unvalidated into the JCR-SQL2 WHERE clause. By observing which conditions change the rendered result set, they perform blind boolean-based extraction to confirm and enumerate unpublished content nodes, or submit malformed/expensive query fragments to degrade availability. No public weaponized exploit is identified, though the vendor advisory and fix commit fully describe the injection point.