Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-82396— Sulu: Stored XSS via media download inline-disposition override

Quick assessment

Affected
sulu sulu
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Sulu 是一个基于 Symfony 框架的开源 PHP 内容管理系统。在 2.6.25 和 3.0.8 之前的版本中， 中的 路由及其管理端变体，对于可脚本化的 MIME 类型会响应 查询参数。存在漏洞的存储型 Content-Type 值包括 、 、 和 。拥有媒体上传权限的攻击者可以存储 HTML、XHTML 或 XML 文档，并创建使用 的链接，从而使应用在 Sulu 源域下返回该文件，而不是强制将文件作为附件（Content-Disposition: attachment）下载。当经过身份验证的受害者打开

CVSS 5.4 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-82396

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Sulu: Stored XSS via media download inline-disposition override
Source: CVE Program / CVE List V5
Vulnerability Description
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/{id}/download/{slug} route and its administration variant to honor the inline query parameter for scriptable MIME types. The vulnerable stored Content-Type values include text/html, application/xhtml+xml, text/xml, and application/xml. An attacker with media upload permission can store an HTML, XHTML, or XML document and create a link using inline=1, causing the application to return the file on the Sulu origin instead of forcing Content-Disposition attachment. When an authenticated victim opens the link, attacker-controlled JavaScript can execute with the victim's Sulu-origin session and can read data or perform actions as that victim. This issue is fixed in versions 2.6.25 and 3.0.8.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
sulu sulu < 2.6.25 -

II. Public POCs for CVE-2026-82396

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-82396

请登录查看更多情报信息。

Other References for CVE-2026-82396 (3)

Same Patch Batch · sulu · 2026-08-31 · 3 CVEs total

CVE-2026-82394 5.3 MEDIUM Sulu: Fix authorization bypass when creating preview links
CVE-2026-82395 5.3 MEDIUM Sulu: Media move/update authorization bypass (IDOR)

IV. Related Vulnerabilities

Same product: sulu
Same vendor: sulu
Same weakness: CWE-79

V. Comments for CVE-2026-82396

No comments yet

Leave a comment