CVE-2026-82396

Name of the Vulnerable Software and Affected Versions Sulu versions prior to 2.6.25 Sulu versions prior to 3.0.8

Description An issue exists in the MediaStreamController.php file where the /media/{id}/download/{slug} endpoint and its administration variant honor the inline query parameter for scriptable MIME types, such as text/html, application/xhtml+xml, text/xml, and application/xml. An attacker with media upload permissions can upload an HTML, XHTML, or XML document and generate a link using inline=1. This causes the application to serve the file from the Sulu origin rather than forcing a Content-Disposition attachment. Consequently, when an authenticated user opens the link, attacker-controlled JavaScript can execute within the user's session, allowing the attacker to read data or perform actions on behalf of the victim.

Recommendations Update to version 2.6.25. Update to version 3.0.8.