CVE-2026-82395 in Sulu
Summary
by MITRE • 08/31/2026
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media item's actual source collection, and src/Sulu/Bundle/MediaBundle/Media/Manager/MediaManager.php allows MediaManager::move() to reassign the item without checking that source. An authenticated backend user with edit permission on one collection and knowledge of a target media identifier can name the allowed collection in the request, move an item out of a restricted collection, and then view or download content the user was not permitted to access. This issue is fixed in versions 2.6.25 and 3.0.8.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/31/2026
Sulu is an open-source PHP-based content management system built upon the Symfony framework, widely utilized for managing digital assets and web content. A critical security flaw was identified within its media handling subsystem prior to versions 2.6.25 and 3.0.8. This vulnerability resides in the MediaManager component, specifically affecting the move operation endpoint which is responsible for reassigning media items between different collections or folders within the system's hierarchical structure. The core technical flaw involves an insecure direct object reference mechanism where the permission check logic relies on a client-supplied parameter rather than validating against the actual source location of the media item being modified.
In a properly secured implementation, when a user requests to move a file from one collection to another, the system must verify that the user has explicit permissions for both the source and destination locations. However, in the affected versions, the MediaManager::move() function derives its authorization decision primarily or exclusively from the collection identifier provided by the client in the HTTP request payload. This design oversight allows an attacker who is authenticated as a backend user with edit privileges on at least one specific collection to manipulate this parameter. By supplying a target media item's unique identifier along with a source collection name that they are authorized to access, the system fails to cross-reference this input against the actual physical or logical location of the specified media file.
The operational impact of this vulnerability is significant for organizations relying on Sulu for sensitive content management. An authenticated attacker can exploit this logic error to bypass access controls and move restricted files out of protected collections into locations where they have permission, such as a public-facing folder or a collection they manage. Once the item has been moved via this unauthorized operation, the attacker gains the ability to view, download, or otherwise interact with content that was originally intended to be confidential or restricted. This constitutes an authorization bypass and represents a clear case of insecure direct object references, allowing for potential data exfiltration even without elevated privileges beyond basic edit rights on any single collection.
From a classification perspective, this vulnerability aligns with CWE-284, which describes Improper Access Control where the application does not properly restrict access to resources based on user roles or permissions. It also maps to MITRE ATT&CK technique T1078, specifically Valid Accounts, as it requires authentication but leverages those credentials to perform actions outside their intended scope through logic manipulation rather than privilege escalation in the traditional sense. The flaw highlights a common pitfall in web application development where trust is placed too heavily on client-side inputs for server-side security decisions without rigorous validation against authoritative state data.
To mitigate this vulnerability, organizations running Sulu must immediately upgrade to version 2.6.25 or later if they are on the legacy branch, or version 3.0.8 and later for newer deployments. These releases contain patches that enforce strict validation of media item locations during move operations, ensuring that permission checks are performed against the actual source collection metadata stored in the database rather than relying solely on user-supplied input. Additionally, developers should review any custom integrations or extensions built upon the MediaManager to ensure they do not replicate this insecure pattern by bypassing standard authorization checks with client-provided identifiers. Regular security audits and static code analysis focused on access control logic can help prevent similar issues in future development cycles.