GHSA-xcwx-r2gw-w93m
Suggest an improvement- Source
- https://github.com/advisories/GHSA-xcwx-r2gw-w93m
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-xcwx-r2gw-w93m/GHSA-xcwx-r2gw-w93m.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-xcwx-r2gw-w93m
- Aliases
- Published
- 2026-03-11T00:13:41Z
- Modified
- 2026-03-13T10:56:25Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- Sylius has a DQL Injection via API Order Filters
- Details
-
Impact
Sylius API filters
ProductPriceOrderFilterandTranslationOrderNameAndLocaleFilterpass user-supplied order direction values directly to Doctrine'sorderBy()without validation. An attacker can inject arbitrary DQL:GET /api/v2/shop/products?order[price]=ASC,%20variant.code%20DESCPatches
The issue is fixed in versions: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3 and above.
Workarounds
An
EventSubscriberthat sanitizesorderquery parameters only on API routes before they reach the vulnerable filters.The subscriber accepts an
$apiRouteconstructor parameter (default/api/v2) and skips non-API requests entirely — so there is zero overhead on shop/admin page requests.This follows the same pattern used by Sylius's own
KernelRequestEventSubscriber(src/Sylius/Bundle/ApiBundle/EventSubscriber/KernelRequestEventSubscriber.php), which also usesstr_contains($pathInfo, $this->apiRoute)to scope logic to API routes.
Step 1 — Create the EventSubscriber
src/EventSubscriber/SanitizeOrderDirectionSubscriber.php:<?php declare(strict_types=1); namespace App\EventSubscriber; use Symfony\Component\EventDispatcher\EventSubscriberInterface; use Symfony\Component\HttpKernel\Event\RequestEvent; use Symfony\Component\HttpKernel\KernelEvents; final class SanitizeOrderDirectionSubscriber implements EventSubscriberInterface { private const ALLOWED_DIRECTIONS = ['asc', 'desc']; public function __construct( private string $apiRoute, ) { } public static function getSubscribedEvents(): array { return [ KernelEvents::REQUEST => ['sanitizeOrderParameters', 64], ]; } public function sanitizeOrderParameters(RequestEvent $event): void { if (!str_contains($event->getRequest()->getPathInfo(), $this->apiRoute)) { return; } $request = $event->getRequest(); /** @var mixed $order */ $order = $request->query->all()['order'] ?? null; if (!is_array($order)) { return; } $needsSanitization = false; $sanitized = []; foreach ($order as $field => $direction) { if (is_string($direction) && in_array(strtolower($direction), self::ALLOWED_DIRECTIONS, true)) { $sanitized[$field] = $direction; } else { $needsSanitization = true; } } if (!$needsSanitization) { return; } $all = $request->query->all(); $all['order'] = $sanitized; $request->query->replace($all); $request->server->set('QUERY_STRING', http_build_query($all)); $request->attributes->set('_api_filters', $all); } }Step 2 — Register the service
Option A — If your
config/services.yamlalready hasApp\autowiring (Symfony default):# Nothing to do — autoconfigure picks up EventSubscriberInterface automatically. # Optionally bind the API route prefix: services: App\EventSubscriber\SanitizeOrderDirectionSubscriber: arguments: $apiRoute: '%sylius.security.new_api_route%'Option B — If there is no
App\autowiring:services: App\EventSubscriber\SanitizeOrderDirectionSubscriber: arguments: $apiRoute: '%sylius.security.new_api_route%' tags: ['kernel.event_subscriber']Using
%sylius.security.new_api_route%ties the subscriber to the same prefix Sylius uses (/api/v2by default). If the parameter is not available, hardcode'/api/v2'instead.Step 3 — Clear cache
bin/console cache:clearReporters
We would like to extend our gratitude to the following individuals for their detailed reporting and responsible disclosure of this vulnerability:
- Chris Alupului (@Neosprings)
- Bartłomiej Nowiński (@bnBart)
For more information
If you have any questions or comments about this advisory:
- Open an issue in Sylius issues
- Email us at security@sylius.com
- Database specific
{ "cwe_ids": [ "CWE-89", "CWE-943" ], "github_reviewed": true, "github_reviewed_at": "2026-03-11T00:13:41Z", "nvd_published_at": "2026-03-10T22:16:20Z", "severity": "MODERATE" }- References
Affected packages
Packagist
sylius/sylius
Package
- Name
- sylius/sylius
- Purl
- pkg:composer/sylius/sylius
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed1.9.12
Affected versions
v0.*
v1.*
sylius/sylius
Package
- Name
- sylius/sylius
- Purl
- pkg:composer/sylius/sylius
sylius/sylius
Package
- Name
- sylius/sylius
- Purl
- pkg:composer/sylius/sylius
sylius/sylius
Package
- Name
- sylius/sylius
- Purl
- pkg:composer/sylius/sylius
sylius/sylius
Package
- Name
- sylius/sylius
- Purl
- pkg:composer/sylius/sylius
sylius/sylius
Package
- Name
- sylius/sylius
- Purl
- pkg:composer/sylius/sylius
sylius/sylius
Package
- Name
- sylius/sylius
- Purl
- pkg:composer/sylius/sylius
sylius/sylius
Package
- Name
- sylius/sylius
- Purl
- pkg:composer/sylius/sylius
sylius/sylius
Package
- Name
- sylius/sylius
- Purl
- pkg:composer/sylius/sylius