Executive brief
Sulu is a PHP-based content management system used to manage web content and media. An authenticated attacker with media upload permissions can upload an HTML file and craft a download link that executes arbitrary JavaScript in the browsers of anyone who opens it—including administrators—allowing theft of sessions and user credentials. This impacts all Sulu installations where non-fully-trusted users can upload media.
Technical details
The vulnerability is a stored XSS in Sulu's media download route (`/media/{id}/download/{slug}` and `/admin/media/{id}/download/{slug}`). The endpoint accepts a query parameter `?inline=1` which forces the response header `Content-Disposition: inline` regardless of MIME type. By default, HTML files are not blocked during upload, and the server does not send restrictive `X-Content-Type-Options` or `Content-Security-Policy` headers. An authenticated user with media add permission can upload an HTML file containing JavaScript payload, then share a link with `?inline=1` appended. When victims visit this link, the browser executes the JavaScript in the Sulu application origin, enabling session theft and account takeover. The flaw has existed since the `?inline` parameter was introduced in 2017. Patches available in versions 2.6.25 and 3.0.8 force `Content-Disposition: attachment` for document MIME types even when `?inline=1` is requested.
Affected products
- Sulu sulu/sulu <= 2.6.24, >= 3.0.0-alpha1 < 3.0.8
Timeline
- 2026-09-02: disclosed: GitHub Advisory published
- 2026-09-02: patched: Fixed in versions 2.6.25 and 3.0.8