CVE-2026-82396
MediumCVSS 5.4Summary
Sulu, a PHP content management system, before versions 2.6.25 and 3.0.8 allows an attacker with media upload permission to store HTML, XHTML, or XML documents and create links with inline=1, causing the application to return the file without Content-Disposition attachment. Opening such a link by an authenticated user allows execution of malicious JavaScript in the context of the victim's session on the Sulu origin.
Risk Assessment
An attacker can steal data or perform actions on behalf of an authenticated user, potentially leading to confidentiality and integrity breaches in the system.
Recommendation
Update Sulu to version 2.6.25 or 3.0.8, which contain a fix for this vulnerability.
Other vulnerabilities in Sulu
See all- CVE-2026-82395Medium
Sulu before versions 2.6.25 and 3.0.8 has a vulnerability in the media move endpoint where the permission check is based on the client-supplied collection value rather than the actual source collection. An authenticated backend user with edit permission in one collection can move an item out of a restricted collection and then view or download content they are not permitted to access.
- CVE-2026-82394Medium
Sulu before versions 2.6.25 and 3.0.8 does not enforce VIEW permission for target resources in the preview-link endpoint. An authenticated administrative user who knows a resource identifier can create or revoke a preview link for any page, article, or snippet, including content they cannot view. The generated preview URL is public and allows reading restricted content without authentication.
- CVE-2026-45701Medium
Sulu, an open-source PHP CMS based on Symfony, before versions 2.6.23 and 3.0.6 uses a weak cryptographic hash algorithm for password reset token and API key generation.
- CVE-2026-34372Low
In Sulu, an open-source PHP CMS based on Symfony, versions 1.0.0 through 2.6.22 and 3.0.0 through 3.0.5, a user with permission for the Sulu Admin via at least one role could access sub-entities of contacts via the admin API without having permission for contacts.
Original NVD description (English source)
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/{id}/download/{slug} route and its administration variant to honor the inline query parameter for scriptable MIME types. The vulnerable stored Content-Type values include text/html, application/xhtml+xml, text/xml, and application/xml. An attacker with media upload permission can store an HTML, XHTML, or XML document and create a link using inline=1, causing the application to return the file on the Sulu origin instead of forcing Content-Disposition attachment. When an authenticated victim opens the link, attacker-controlled JavaScript can execute with the victim's Sulu-origin session and can read data or perform actions as that victim. This issue is fixed in versions 2.6.25 and 3.0.8.