Skip to content
Heist/ feed
Back to feed
Medium

Sulu: Stored XSS via media download inline-disposition override

Type: advisorySources: OSV

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/{id}/download/{slug} route and its administration variant to honor the inline query parameter for scriptable MIME types. The vulnerable stored Content-Type values include text/html, application/xhtml+xml, text/xml, and application/xml. An attacker with media upload permission can store an HTML, XHTML, or XML document and create a link using inline=1, causing the application to return the file on the Sulu origin instead of forcing Content-Disposition attachment. When an authenticated victim opens the link, attacker-controlled JavaScript can execute with the victim's Sulu-origin session and can read data or perform actions as that victim. This issue is fixed in versions 2.6.25 and 3.0.8.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-82396
Confirmed fixed CVEs
Not specified
Updated in this feed
5 Nov 2026, 03:52 UTC · Revision 1

Source evidence

Sulu: Stored XSS via media download inline-disposition override

core-osv · Original source

Published 31 Aug 2026, 21:23 UTC

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/{id}/download/{slug} route and its administration variant to honor the inline query parameter for scriptable MIME types. The vulnerable stored Content-Type values include text/html, application/xhtml+xml, text/xml, and application/xml. An attacker with media upload permission can store an HTML, XHTML, or XML document and create a link using inline=1, causing the application to return the file on the Sulu origin instead of forcing Content-Disposition attachment. When an authenticated victim opens the link, attacker-controlled JavaScript can execute with the victim's Sulu-origin session and can read data or perform actions as that victim. This issue is fixed in versions 2.6.25 and 3.0.8.

osv:CVE-2026-82396
Complete source record
{
  "id": "37767de29059db42f7b0e0553ab5699b94dd97ebb27aacabccb47a44b395d923",
  "url": "https://osv.dev/vulnerability/CVE-2026-82396",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Sulu: Stored XSS via media download inline-disposition override",
    "summary": "Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/{id}/download/{slug} route and its administration variant to honor the inline query parameter for scriptable MIME types. The vulnerable stored Content-Type values include text/html, application/xhtml+xml, text/xml, and application/xml. An attacker with media upload permission can store an HTML, XHTML, or XML document and create a link using inline=1, causing the application to return the file on the Sulu origin instead of forcing Content-Disposition attachment. When an authenticated victim opens the link, attacker-controlled JavaScript can execute with the victim's Sulu-origin session and can read data or perform actions as that victim. This issue is fixed in versions 2.6.25 and 3.0.8.",
    "evidence": "osv:CVE-2026-82396",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-82396",
      "aliases": [
        "CVE-2026-82396",
        "GHSA-pp4x-ccxq-6r33"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/sulu/sulu",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "2641e81e2f1480b0c7ce37b622704e1fe040785b"
                },
                {
                  "introduced": "9362e10753d0284b3265a66c288473cc0ab570d7"
                },
                {
                  "fixed": "576d465a8fb91de5bd45dd3b88834a062880e496"
                },
                {
                  "fixed": "d061094f5b7bb1d5e974544fce30bede9c7adf8e"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.6.25"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "introduced": "3.0.0-alpha1"
                      },
                      {
                        "fixed": "3.0.8"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "d061094f5b7bb1d5e974544fce30bede9c7adf8e"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "2641e81e2f1480b0c7ce37b622704e1fe040785b"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "2.6.25"
                  },
                  {
                    "range": [
                      {
                        "fixed": "576d465a8fb91de5bd45dd3b88834a062880e496"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "3.0.8"
                  }
                ]
              }
            }
          ],
          "versions": [
            "3.0.7",
            "2.6.24",
            "2.6.23",
            "3.0.6",
            "2.6.22",
            "3.0.5",
            "2.6.21",
            "3.0.4",
            "2.6.20",
            "3.0.3",
            "2.6.19",
            "3.0.2",
            "2.6.18",
            "3.0.1",
            "3.0.0",
            "2.6.17",
            "3.0.0-RC2",
            "2.6.16",
            "3.0.0-RC1",
            "3.0.0-beta4",
            "2.6.15",
            "2.6.14",
            "3.0.0-beta3",
            "2.6.13",
            "3.0.0-beta2",
            "2.6.12",
            "3.0.0-beta1",
            "2.6.11",
            "3.0.0-alpha5",
            "3.0.0-alpha4",
            "2.6.10",
            "2.6.9",
            "3.0.0-alpha3",
            "2.6.8",
            "3.0.0-alpha1",
            "2.6.7",
            "2.6.6",
            "2.6.5",
            "2.6.4",
            "2.6.3",
            "2.6.2",
            "2.6.1",
            "2.6.0",
            "2.6.0-RC2",
            "2.6.0-RC1",
            "2.5.1",
            "2.5.0",
            "2.5.0-alpha1",
            "2.4.0",
            "2.4.0-RC1",
            "2.3.1",
            "2.3.0",
            "2.3.0-RC2",
            "2.3.0-RC1",
            "2.2.1",
            "2.2.0",
            "2.2.0-RC1",
            "2.1.0-RC1",
            "2.0.0",
            "2.0.0-RC3",
            "2.0.0-RC2",
            "2.0.0-RC1",
            "2.0.0-alpha6",
            "2.0.0-alpha5",
            "2.0.0-alpha4",
            "2.0.0-alpha3",
            "2.0.0-alpha2",
            "2.0.0-alpha1",
            "1.6.0-RC1",
            "1.5.0-RC3",
            "1.5.0-RC2",
            "1.5.0-RC1",
            "1.4.0-RC2",
            "1.4.0-RC1",
            "0.8.4",
            "0.8.5",
            "0.8.3",
            "0.8.0",
            "0.7.1",
            "0.7.0",
            "0.6.8",
            "0.6.5",
            "0.6.4",
            "0.6.3",
            "0.6.2",
            "0.6.1",
            "0.6.0",
            "0.5.0",
            "0.4.0",
            "0.2.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82396.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:42.354488857Z",
      "provider": "osv",
      "references": [
        "https://github.com/sulu/sulu/releases/tag/2.6.25",
        "https://github.com/sulu/sulu/releases/tag/3.0.8",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82396.json",
        "https://github.com/sulu/sulu/security/advisories/GHSA-pp4x-ccxq-6r33",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-82396",
        "https://github.com/sulu/sulu/commit/d061094f5b7bb1d5e974544fce30bede9c7adf8e"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-79"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82396.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-82396",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 510013,
  "published_at": "2026-08-31T21:23:16.852+00:00"
}