# CVE-2026-82396: Sulu stored XSS via media download inline-disposition override

Source: https://junglewise.ai/threats/cve-2026-82396-sulu-stored-xss-via-media-download-inline-disposition-override  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82396 · Severity: medium · CVSS 5.4 · Published 2026-08-31

Sulu is a PHP-based content management system used to manage web content and media. An authenticated attacker with media upload permissions can upload an HTML file and craft a download link that executes arbitrary JavaScript in the browsers of anyone who opens it—including administrators—allowing theft of sessions and user credentials. This impacts all Sulu installations where non-fully-trusted users can upload media.

Technologies: [sulu/sulu (Packagist)](https://junglewise.ai/threats/technologies/sulu-sulu), [Sulu](https://junglewise.ai/threats/technologies/sulu). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Sulu](https://junglewise.ai/threats/vendors/sulu).

## Quick answers

**Is CVE-2026-82396 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82396 being exploited in the wild.

**How severe is CVE-2026-82396?** Medium severity, with a CVSS score of 5.4, published 31 August 2026.

**Which products and versions are affected?** sulu/sulu (Packagist) ECOSYSTEM:introduced=0,fixed=2.6.25; Sulu <= 2.6.24, >= 3.0.0-alpha1 < 3.0.8.

**Is there a fix for CVE-2026-82396?** Yes. sulu/sulu (Packagist): upgrade to 2.6.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82396 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-82396?** Check whether you run sulu/sulu (Packagist) or Sulu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- sulu/sulu (Packagist): upgrade to 2.6.25 or later

  ```sh
  composer require sulu/sulu:^2.6.25
  ```


## Technical details

The vulnerability is a stored XSS in Sulu's media download route (`/media/{id}/download/{slug}` and `/admin/media/{id}/download/{slug}`). The endpoint accepts a query parameter `?inline=1` which forces the response header `Content-Disposition: inline` regardless of MIME type. By default, HTML files are not blocked during upload, and the server does not send restrictive `X-Content-Type-Options` or `Content-Security-Policy` headers. An authenticated user with media add permission can upload an HTML file containing JavaScript payload, then share a link with `?inline=1` appended. When victims visit this link, the browser executes the JavaScript in the Sulu application origin, enabling session theft and account takeover. The flaw has existed since the `?inline` parameter was introduced in 2017. Patches available in versions 2.6.25 and 3.0.8 force `Content-Disposition: attachment` for document MIME types even when `?inline=1` is requested.

## Affected products

- Sulu sulu/sulu <= 2.6.24, >= 3.0.0-alpha1 < 3.0.8

## Identifiers

- CVE-2026-82396
- GHSA-pp4x-ccxq-6r33

## Timeline

- 2026-09-02: disclosed: GitHub Advisory published
- 2026-09-02: patched: Fixed in versions 2.6.25 and 3.0.8

## References

- [https://api.github.com/users/0x3xP01t3r](https://api.github.com/users/0x3xP01t3r)
- [https://github.com/0x3xP01t3r](https://github.com/0x3xP01t3r)
- [https://api.github.com/users/0x3xP01t3r/gists%7B/gist_id%7D](https://api.github.com/users/0x3xP01t3r/gists%7B/gist_id%7D)
- [https://api.github.com/users/0x3xP01t3r/repos](https://api.github.com/users/0x3xP01t3r/repos)
- [https://avatars.githubusercontent.com/u/152601420?v=4](https://avatars.githubusercontent.com/u/152601420?v=4)
- [https://api.github.com/users/0x3xP01t3r/events%7B/privacy%7D](https://api.github.com/users/0x3xP01t3r/events%7B/privacy%7D)

## Related threats

- [Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.](https://junglewise.ai/threats/cve-2026-92692-sulu-jcr-sql2-injection-in-category-filter)
- [Sulu media move authorization bypass (IDOR)](https://junglewise.ai/threats/cve-2026-82395-sulu-media-move-authorization-bypass-idor)
- [Sulu authorization bypass in preview link generation](https://junglewise.ai/threats/cve-2026-82394-sulu-authorization-bypass-in-preview-link-generation)
- [Sulu CMS weak cryptographic hash in password reset and API keys](https://junglewise.ai/threats/cve-2026-45701-sulu-cms-weak-cryptographic-hash-in-password-reset-and-api-keys)
- [Sulu Sulu information disclosure in Admin API](https://junglewise.ai/threats/sulu-sulu-information-disclosure-in-admin-api-2bb43ba4)