CVE-2026-45701

Sulu, a PHP content management system, before versions 2.6.25 and 3.0.8 allows an attacker with media upload permission to store HTML, XHTML, or XML documents and create links with inline=1, causing the application to return the file without Content-Disposition attachment. Opening such a link by an authenticated user allows execution of malicious JavaScript in the context of the victim's session on the Sulu origin.

Sulu before versions 2.6.25 and 3.0.8 has a vulnerability in the media move endpoint where the permission check is based on the client-supplied collection value rather than the actual source collection. An authenticated backend user with edit permission in one collection can move an item out of a restricted collection and then view or download content they are not permitted to access.

Sulu before versions 2.6.25 and 3.0.8 does not enforce VIEW permission for target resources in the preview-link endpoint. An authenticated administrative user who knows a resource identifier can create or revoke a preview link for any page, article, or snippet, including content they cannot view. The generated preview URL is public and allows reading restricted content without authentication.

In Sulu, an open-source PHP CMS based on Symfony, versions 1.0.0 through 2.6.22 and 3.0.0 through 3.0.5, a user with permission for the Sulu Admin via at least one role could access sub-entities of contacts via the admin API without having permission for contacts.