CVE-2026-82396

Received Received - Intake

Stored XSS in Sulu CMS via Media Download

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/{id}/download/{slug} route and its administration variant to honor the inline query parameter for scriptable MIME types. The vulnerable stored Content-Type values include text/html, application/xhtml+xml, text/xml, and application/xml. An attacker with media upload permission can store an HTML, XHTML, or XML document and create a link using inline=1, causing the application to return the file on the Sulu origin instead of forcing Content-Disposition attachment. When an authenticated victim opens the link, attacker-controlled JavaScript can execute with the victim's Sulu-origin session and can read data or perform actions as that victim. This issue is fixed in versions 2.6.25 and 3.0.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-82396

Affected Vendors & Products

Vendor	Product	Version / Range
sulu	sulu	to 2.6.25 (inc)
sulu	sulu	to 3.0.8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Sulu is a PHP content management system. A flaw in versions before 2.6.25 and 3.0.8 allows attackers with media upload permissions to upload HTML, XHTML, or XML files. When accessed with a specific parameter, these files are served inline instead of as downloads, enabling JavaScript execution in the victim's Sulu session.

Detection Guidance

Check Sulu versions for 2.6.25 or 3.0.8 or higher. Review media upload permissions and stored Content-Type values for text/html, application/xhtml+xml, text/xml, or application/xml. Inspect routes for /media/{id}/download/{slug} with inline=1 parameter.

Impact Analysis

If exploited, an attacker could execute malicious JavaScript in your Sulu session. This could allow them to read your data or perform actions as you within the application, potentially leading to unauthorized access or data theft.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using affected Sulu versions may face compliance breaches if exploited.

Mitigation Strategies

Upgrade Sulu to versions 2.6.25 or 3.0.8 or later. Restrict media upload permissions to trusted users. Validate and sanitize stored Content-Type values. Disable inline parameter for scriptable MIME types in media download routes.

Hi! I’m here to help you understand CVE-2026-82396. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70