Sulu is an open-source PHP content management system based on the Symfony framework

Overview

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media item's actual source collection, and src/Sulu/Bundle/MediaBundle/Media/Manager/MediaManager.php allows MediaManager::move() to reassign the item without checking that source. An authenticated backend user with edit permission on one collection and knowledge of a target media identifier can name the allowed collection in the request, move an item out of a restricted collection, and then view or download content the user was not permitted to access. This issue is fixed in versions 2.6.25 and 3.0.8.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Package advisory (CVE-2026-82395)

Affected packages:

• sulu/sulu <= 2.6.24
• sulu/sulu >= 3.0.0-alpha1, < 3.0.8

Patched in:

• sulu/sulu 2.6.25
• sulu/sulu 3.0.8

Source: https://github.com/advisories/GHSA-h6cx-gjxx-v25c