Sulu’s Smart Content QueryBuilder concatenates category identifiers from the public categories query parameter into a JCR‑SQL2 WHERE clause without validating that the identifiers are numeric. This flaw permits an unauthenticated attacker to alter the query conditions, enabling the inference or enumeration of repository nodes, including unpublished content. The attacker can also craft malformed or expensive query fragments that may reduce the availability of the affected page. The vulnerability does not modify the underlying repository data but can expose sensitive information or degrade service performance.

The vulnerability affects Sulu CMS versions on the 2.6 and 3.0 release lines that are older than 2.6.25 and 3.0.8, respectively. These are the last releases of the 2.6.x and 3.0.x lines before the fix was applied. Users running any 2.6.x prior to 2.6.25 or any 3.0.x prior to 3.0.8 are impacted.

The CVSS score of 6.9 indicates a moderate impact. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is unauthenticated and relies on a public page containing a Smart Content block that accepts a categories query parameter. An attacker can invoke the vulnerable endpoint by manipulating the URL or form data, making this easily exploitable without special credentials. The flaw can lead to theft of unpublished content and possible denial‑of‑service via resource‑hungry queries.