Description

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/{id}/download/{slug} route and its administration variant to honor the inline query parameter for scriptable MIME types. The vulnerable stored Content-Type values include text/html, application/xhtml+xml, text/xml, and application/xml. An attacker with media upload permission can store an HTML, XHTML, or XML document and create a link using inline=1, causing the application to return the file on the Sulu origin instead of forcing Content-Disposition attachment. When an authenticated victim opens the link, attacker-controlled JavaScript can execute with the victim's Sulu-origin session and can read data or perform actions as that victim. This issue is fixed in versions 2.6.25 and 3.0.8.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-31T22:17:22.780Z",
  "pubdate": "2026-08-31T22:17:22.780Z",
  "executiveSummary": "Sulu CMS is affected by a stored Cross-Site Scripting (XSS) vulnerability due to improper handling of the 'inline' query parameter within the media download controller.\nThe vulnerability allows an attacker with media upload privileges to store malicious scriptable MIME types (HTML, XML, XHTML) and trigger their execution within the victim's session.\nBy manipulating the '/media/{id}/download/{slug}' route, an attacker can bypass Content-Disposition restrictions, forcing the application to render the malicious content directly in the browser.\nExploitation results in the execution of arbitrary JavaScript within the security context of the Sulu origin.\nThe impact includes unauthorized data exfiltration, session hijacking, and the ability for an attacker to perform actions on behalf of an authenticated victim.\nThis vulnerability poses a significant risk to administrative interfaces and authenticated user environments, necessitating immediate patching of the affected Sulu CMS versions.",
  "technicalDetails": "The vulnerability originates in 'src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php', which governs the retrieval and serving of media assets.\nThe 'MediaStreamController' improperly handles the 'inline' query parameter when serving stored media files. Typically, file downloads should be forced via the 'Content-Disposition: attachment' header to prevent browser-side parsing of potentially executable files.\nBy setting 'inline=1', the application instructs the browser to render the media content directly, provided the MIME type is supported. The controller fails to validate the Content-Type of the stored file against a whitelist of safe, non-scriptable types.\nAffected MIME types include 'text/html', 'application/xhtml+xml', 'text/xml', and 'application/xml', all of which allow for the execution of embedded JavaScript or malicious XML-based payloads.\nThe attack flow requires the adversary to possess 'media upload' permissions within the Sulu CMS instance. The attacker uploads a crafted document containing malicious scripts and subsequently generates a URL pointing to the '/media/{id}/download/{slug}' route with the 'inline=1' parameter.\nWhen an authenticated victim, such as an administrator, accesses the crafted URL, the server responds with the malicious file and the browser renders it in the context of the application's origin.\nBecause the content is rendered on the Sulu origin, the attacker's script inherits the victim's session cookies and security context. This grants the script the ability to interact with the DOM, intercept sensitive data, or perform authenticated actions (e.g., creating new users or changing settings) without the victim's knowledge or consent.\nThis vulnerability affects versions of Sulu prior to 2.6.25 and 3.0.8. The core issue is an insufficient security constraint on file serving logic that fails to enforce secure download headers for user-provided content.\nThe post-exploitation scenario allows for full account takeover if the script targets high-privilege sessions and exfiltrates session tokens or CSRF values, effectively bypassing origin-based security protections."
}