CVE-2021-43822: SQL injection in jackalope/jackalope-doctrine-dbal

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-12-13 · updated 2026-06-17
Weakness: CWE-89

Description

Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can specify a node name or query. Upgrade to version 1.7.4 to resolve this issue. If that is not possible, you can escape all places where `$property` is used to filter `sv:name` in the class `Jackalope\Transport\DoctrineDBAL\Query\QOMWalker`: `XPath::escape($property)`. Node names and xpaths can contain `"` or `;` according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection. If queries are never done from user input, or if you validate the user input to not contain `;`, you are not affected.

Affected products

jackalope-doctrine-dbal: before 1.7.4 — fixed in 1.7.4

How to fix

Upgrade to a fixed version: jackalope-doctrine-dbal 1.7.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-43822 or the next vulnerability affects your stack