{"id":"CVE-2026-82396","title":"Sulu is an open-source PHP content management system based on the Symfony framework","summary":"Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/{id}/download/{slug} route and it…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"sulu","product":"sulu/sulu","affected":["sulu/sulu <= 2.6.24","sulu/sulu >= 3.0.0-alpha1, < 3.0.8"],"patched":["sulu/sulu 2.6.25","sulu/sulu 3.0.8"],"published":"2026-08-31","updated":"2026-09-08","sourceUpdated":"2026-09-08T21:11:31.703","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82396","references":[{"url":"https://github.com/sulu/sulu/commit/d061094f5b7bb1d5e974544fce30bede9c7adf8e","label":"security-advisories@github.com"},{"url":"https://github.com/sulu/sulu/releases/tag/2.6.25","label":"security-advisories@github.com"},{"url":"https://github.com/sulu/sulu/releases/tag/3.0.8","label":"security-advisories@github.com"},{"url":"https://github.com/sulu/sulu/security/advisories/GHSA-pp4x-ccxq-6r33","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82396"},{"url":"https://github.com/advisories/GHSA-pp4x-ccxq-6r33"}],"tags":["nvd","ghsa","composer"],"epss":0.00171,"epssPercentile":0.06831,"aliases":["GHSA-pp4x-ccxq-6r33"],"ecosystem":"composer","ingestedAt":"2026-09-02T15:46:29.660Z","slug":"CVE-2026-82396","body":"## Overview\n\nSulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/{id}/download/{slug} route and its administration variant to honor the inline query parameter for scriptable MIME types. The vulnerable stored Content-Type values include text/html, application/xhtml+xml, text/xml, and application/xml. An attacker with media upload permission can store an HTML, XHTML, or XML document and create a link using inline=1, causing the application to return the file on the Sulu origin instead of forcing Content-Disposition attachment. When an authenticated victim opens the link, attacker-controlled JavaScript can execute with the victim's Sulu-origin session and can read data or perform actions as that victim. This issue is fixed in versions 2.6.25 and 3.0.8.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-82396)\n\nAffected packages:\n\n- `sulu/sulu <= 2.6.24`\n- `sulu/sulu >= 3.0.0-alpha1, < 3.0.8`\n\nPatched in:\n\n- `sulu/sulu 2.6.25`\n- `sulu/sulu 3.0.8`\n\nSource: https://github.com/advisories/GHSA-pp4x-ccxq-6r33","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}