CVE-2026-82396 in Sulu
Summary
by MITRE • 08/31/2026
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/{id}/download/{slug} route and its administration variant to honor the inline query parameter for scriptable MIME types. The vulnerable stored Content-Type values include text/html, application/xhtml+xml, text/xml, and application/xml. An attacker with media upload permission can store an HTML, XHTML, or XML document and create a link using inline=1, causing the application to return the file on the Sulu origin instead of forcing Content-Disposition attachment. When an authenticated victim opens the link, attacker-controlled JavaScript can execute with the victim's Sulu-origin session and can read data or perform actions as that victim. This issue is fixed in versions 2.6.25 and 3.0.8.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/31/2026
Sulu is a widely deployed open-source content management system built upon the Symfony framework, serving many enterprise environments where secure media handling is critical for operational integrity. A significant security flaw was identified within the MediaStreamController component of Sulu versions prior to 2.6.25 and 3.0.8. This vulnerability centers on the improper validation of MIME types associated with stored content, specifically affecting the /media/{id}/download/{slug} route and its administrative counterpart. The core technical flaw lies in how the application processes the inline query parameter when serving media files. When this parameter is set to one, the system attempts to render the file directly within the browser context rather than forcing a download via Content-Disposition attachment headers. However, the validation logic fails to adequately sanitize or restrict scriptable MIME types such as text/html, application/xhtml+xml, text/xml, and application/xml. This oversight allows an attacker who possesses media upload permissions to store malicious content with these specific MIME type classifications within the system's storage infrastructure.
The operational impact of this vulnerability is severe, primarily manifesting as a stored cross-site scripting attack vector that leverages server-side configuration errors. By uploading a file containing executable JavaScript code and assigning it one of the vulnerable MIME types, an attacker can generate a link using the inline parameter. When an authenticated user with sufficient privileges clicks or accesses this link, the Sulu application serves the malicious content directly from its own origin domain. Because the response originates from the trusted Sulu server, browser security policies such as the same-origin policy do not block the execution of the embedded script. Consequently, the attacker-controlled JavaScript executes within the context of the victim's active session, granting the adversary full access to sensitive data and administrative capabilities associated with that user account. This effectively bypasses standard cross-site scripting mitigations because the malicious payload is delivered from a trusted source rather than an external domain.
From a classification perspective, this vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting (XSS). Specifically, it represents a variant where the server-side logic incorrectly interprets user-controlled input regarding content type handling, leading to the execution of unintended scripts. In terms of offensive security frameworks, this attack pattern corresponds to ATT&CK technique T1059, Command and Scripting Interpreter, specifically through browser-based scripting mechanisms like JavaScript. The exploitation chain relies on social engineering or link manipulation to trigger the delivery mechanism, falling under initial access vectors that exploit trusted relationships between users and applications.
To mitigate this risk, organizations running Sulu must immediately upgrade to version 2.6.25 or later for the legacy branch, or version 3.0.8 and above for newer deployments. These updates implement stricter validation logic that prevents scriptable MIME types from being served with inline rendering enabled. For environments where upgrading is not immediately feasible, administrators should consider implementing a Web Application Firewall rule to block requests containing the inline parameter combined with suspicious content-type headers or file extensions associated with executable scripts. Additionally, enforcing strict Content Security Policy headers can help mitigate the impact of any residual XSS attempts by restricting script execution sources. Regular audits of uploaded media files and limiting upload permissions to trusted users further reduce the attack surface available for this specific exploitation path.