CVE-2026-82396: Sulu: Stored XSS via media download inline-disposition override
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/{id}/download/{slug} route and its administration variant to honor the inline query parameter for scriptable MIME types. The vulnerable stored Content-Type values include text/html, application/xhtml+xml, text/xml, and application/xml. An attacker with media upload permission can store an HTML, XHTML, or XML document and create a link using inline=1, causing the application to return the file on the Sulu origin instead of forcing Content-Disposition attachment. When an authenticated victim opens the link, attacker-controlled JavaScript can execute with the victim's Sulu-origin session and can read data or perform actions as that victim. This issue is fixed in versions 2.6.25 and 3.0.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suluto a version that resolves this vulnerability.Fixed in 2.6.25 - Upgrade
Upgrade
suluto a version that resolves this vulnerability.Fixed in 3.0.8
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs permission to upload media in Sulu. They can upload an HTML, XHTML, or XML document with a scriptable Content-Type and send a crafted media download link containing inline=1 to an authenticated victim.
Which deployments are affected?
Sulu versions before 2.6.25 and 3.0.8 are affected. The exposed endpoints are the /media/{id}/download/{slug} route and its administration variant when they honor inline=1 for text/html, application/xhtml+xml, text/xml, or application/xml content.
What is the impact if a victim opens a malicious link?
The uploaded document is served inline on the Sulu origin rather than as a forced download. Its JavaScript can run using the victim's Sulu-origin session, allowing it to read data or perform actions available to that victim.
What should be done to remediate the issue?
Upgrade to Sulu 2.6.25 or 3.0.8. If an immediate upgrade is not possible, do not allow untrusted users to retain media upload permission and avoid opening media download links with inline=1 for HTML, XHTML, or XML uploads.