AIKIDO-2026-833401

TL;DR

The SearchHelper class interpolates a user-controlled meta-field name from a search term directly into a Doctrine Query Language query without sanitization. When a search term is formatted as FIELDNAME:VALUE, the FIELDNAME portion is used as-is via string concatenation to build DQL subquery aliases. Any authenticated user can inject special characters to trigger query errors across search endpoints, manipulate the DQL string, and in development mode leak DQL structure and schema details through error responses. The fix generates the DQL identifier internally so no user input reaches the query string.