CVE-2026-82396

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php allows the /media/{id}/download/{slug} route and its administration variant to honor the inline query parameter for scriptable MIME types. The vulnerable stored Content-Type values include text/html, application/xhtml+xml, text/xml, and application/xml. An attacker with media upload permission can store an HTML, XHTML, or XML document and create a link using inline=1, causing the application to return the file on the Sulu origin instead of forcing Content-Disposition attachment. When an authenticated victim opens the link, attacker-controlled JavaScript can execute with the victim's Sulu-origin session and can read data or perform actions as that victim. This issue is fixed in versions 2.6.25 and 3.0.8.

• CWE-79

• https://github.com/sulu/sulu/commit/d061094f5b7bb1d5e974544fce30bede9c7adf8e
• https://github.com/sulu/sulu/releases/tag/2.6.25
• https://github.com/sulu/sulu/releases/tag/3.0.8
• https://github.com/sulu/sulu/security/advisories/GHSA-pp4x-ccxq-6r33

Published

Aug 31, 2026

Last Modified

Sep 1, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8238Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/cc…5.3
• CVE-2026-8239Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/cc…5.3
• CVE-2026-82392pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 …7.1
• CVE-2026-82393pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnp…7.5
• CVE-2026-82394Sulu is an open-source PHP content management system based o…5.3
• CVE-2026-82395Sulu is an open-source PHP content management system based o…5.3
• CVE-2026-82397Tornado is a Python web framework and asynchronous networkin…7.5
• CVE-2026-82398pypdf is a free and open-source pure-python PDF library. Pri…6.9
• CVE-2026-8240Concrete CMS 9.5.0 and below is vulnerable to unauthenticate…5.3
• CVE-2026-82404TOON is a compact, human-readable serialization of JSON data…8.3
• CVE-2026-8241A vulnerability has been found in Industrial Application Sof…5.5
• CVE-2026-82417### Summary `qs.stringify` throws a `TypeError` when it s…5.3