CVE-2026-82396: Sulu stored XSS via media download inline-disposition override

CVE-2026-82396 · Severity: medium · CVSS 5.4 · Published 2026-08-31

Sulu is a PHP-based content management system used to manage web content and media. An authenticated attacker with media upload permissions can upload an HTML file and craft a download link that executes arbitrary JavaScript in the browsers of anyone who opens it—including administrators—allowing theft of sessions and user credentials. This impacts all Sulu installations where non-fully-trusted users can upload media.

Technologies: sulu/sulu (Packagist), Sulu. Vendors: Packagist, Sulu.

Quick answers

Is CVE-2026-82396 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-82396 being exploited in the wild.
How severe is CVE-2026-82396?
Medium severity, with a CVSS score of 5.4, published 31 August 2026.
Which products and versions are affected?
sulu/sulu (Packagist) ECOSYSTEM:introduced=0,fixed=2.6.25; Sulu <= 2.6.24, >= 3.0.0-alpha1 < 3.0.8.
Is there a fix for CVE-2026-82396?
Yes. sulu/sulu (Packagist): upgrade to 2.6.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82396 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-82396?
Check whether you run sulu/sulu (Packagist) or Sulu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • sulu/sulu (Packagist): upgrade to 2.6.25 or later
    composer require sulu/sulu:^2.6.25

Technical details

The vulnerability is a stored XSS in Sulu's media download route (`/media/{id}/download/{slug}` and `/admin/media/{id}/download/{slug}`). The endpoint accepts a query parameter `?inline=1` which forces the response header `Content-Disposition: inline` regardless of MIME type. By default, HTML files are not blocked during upload, and the server does not send restrictive `X-Content-Type-Options` or `Content-Security-Policy` headers. An authenticated user with media add permission can upload an HTML file containing JavaScript payload, then share a link with `?inline=1` appended. When victims visit this link, the browser executes the JavaScript in the Sulu application origin, enabling session theft and account takeover. The flaw has existed since the `?inline` parameter was introduced in 2017. Patches available in versions 2.6.25 and 3.0.8 force `Content-Disposition: attachment` for document MIME types even when `?inline=1` is requested.

Affected products

  • Sulu sulu/sulu <= 2.6.24, >= 3.0.0-alpha1 < 3.0.8

Identifiers

  • CVE-2026-82396
  • GHSA-pp4x-ccxq-6r33

Timeline

  • 2026-09-02: disclosed: GitHub Advisory published
  • 2026-09-02: patched: Fixed in versions 2.6.25 and 3.0.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.