Is CVE-2026-92692 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92692 being exploited in the wild.

How severe is CVE-2026-92692?

Medium severity, with a CVSS score of 4, published 23 September 2026.

Which products and versions are affected?

sulu/sulu (Packagist) ECOSYSTEM:introduced=0,fixed=2.6.25; Sulu 2.x before 2.6.25, 3.x before 3.0.8.

Is there a fix for CVE-2026-92692?

Yes. sulu/sulu (Packagist): upgrade to 2.6.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-92692 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-92692?

Check whether you run sulu/sulu (Packagist) or Sulu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92692: Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.

CVE-2026-92692 · Severity: medium · CVSS 4 · Published 2026-09-23

Sulu is a content management system used to publish and manage website content. A flaw in its Smart Content category filter allows any anonymous visitor to inject malicious SQL-like queries through a public web parameter, potentially revealing unpublished pages and other sensitive content, or causing the site to become slow or unresponsive.

Technologies: sulu/sulu (Packagist), Sulu. Vendors: Packagist, Sulu.

Quick answers

Is CVE-2026-92692 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92692 being exploited in the wild.
How severe is CVE-2026-92692?: Medium severity, with a CVSS score of 4, published 23 September 2026.
Which products and versions are affected?: sulu/sulu (Packagist) ECOSYSTEM:introduced=0,fixed=2.6.25; Sulu 2.x before 2.6.25, 3.x before 3.0.8.
Is there a fix for CVE-2026-92692?: Yes. sulu/sulu (Packagist): upgrade to 2.6.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92692 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-92692?: Check whether you run sulu/sulu (Packagist) or Sulu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

sulu/sulu (Packagist): upgrade to 2.6.25 or later
```
composer require sulu/sulu:^2.6.25
```

Technical details

A JCR-SQL2 injection vulnerability exists in the Smart Content category filter of Sulu 2.x, where category IDs from the public `categories` query parameter are trimmed but concatenated directly into a JCR-SQL2 WHERE clause without numeric validation. Unlike the existing tag filter, category IDs are not cast to integers before use in the query. An unauthenticated attacker can exploit this via any public page rendering a Smart Content element with category filtering enabled, allowing blind boolean-based content enumeration (disclosure of unpublished nodes) and denial-of-service through malformed queries. The impact is limited to reading and enumerating content-repository nodes; data modification is not possible through this path. The vulnerability has been patched in versions 2.6.25 and 3.0.8 by casting all ID parameters to integers.

Affected products

Sulu Sulu 2.x before 2.6.25, 3.x before 3.0.8

Identifiers

CVE-2026-92692
GHSA-jg26-q8hg-3pq4

Timeline

2026-09-23: disclosed
2026-09-23: patched: Fixed in versions 2.6.25 and 3.0.8

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.