PHP/sulu/sulu/2.6.2
Core framework that implements the functionality of the Sulu content management system
https://packagist.org/packages/sulu/sulu
MIT
3 Security Vulnerabilities
GHSA-255w-87rh-rg44
Published date: 2024-10-03T18:25:40Z
CVE: CVE-2024-47618
Links:
Cross-site Scripting via uploaded SVG
In Sulu v2.0.0 through v2.6.4 are vulnerable against XSS whereas a low privileged user with an access to the “Media” section can upload an SVG file with a malicious payload. Once uploaded and accessed, the malicious javascript will be executed on the victims’ (other users including admins) browsers.
Affected versions: ["2.6.4", "2.6.3", "2.6.2", "2.6.1", "2.6.0", "2.6.0-RC2", "2.6.0-RC1", "2.5.20", "2.5.19", "2.5.18", "2.5.17", "2.5.16", "2.5.15", "2.5.14", "2.5.13", "2.5.12", "2.5.11", "2.5.10", "2.5.9", "2.5.8", "2.5.7", "2.5.6", "2.5.5", "2.5.4", "2.5.3", "2.5.2", "2.5.1", "2.5.0", "2.5.0-alpha1", "2.4.20", "2.4.19", "2.4.18", "2.4.17", "2.4.16", "2.4.15", "2.4.14", "2.4.13", "2.4.12", "2.4.11", "2.4.10", "2.4.9", "2.4.8", "2.4.7", "2.4.6", "2.4.5", "2.4.4", "2.4.3", "2.4.2", "2.4.1", "2.4.0", "2.4.0-RC1", "2.3.13", "2.3.12", "2.3.11", "2.3.10", "2.3.9", "2.3.8", "2.3.7", "2.3.6", "2.3.5", "2.3.4", "2.3.3", "2.3.2", "2.3.1", "2.3.0", "2.3.0-RC2", "2.3.0-RC1", "2.2.19", "2.2.18", "2.2.17", "2.2.16", "2.2.15", "2.2.14", "2.2.13", "2.2.12", "2.2.11", "2.2.10", "2.2.9", "2.2.8", "2.2.7", "2.2.6", "2.2.5", "2.2.4", "2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.2.0-RC1", "2.1.14", "2.1.13", "2.1.12", "2.1.11", "2.1.10", "2.1.9", "2.1.8", "2.1.7", "2.1.6", "2.1.5", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.1.0-RC2", "2.1.0-RC1", "2.0.12", "2.0.11", "2.0.10", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0", "2.0.0-RC3", "2.0.0-RC2", "2.0.0-RC1"]
Secure versions: [2.6.22, 3.0.0-RC1, 3.0.0-RC2, 3.0.0-alpha3, 3.0.0-alpha4, 3.0.0-alpha5, 3.0.0-beta1, 3.0.0-beta2, 3.0.0-beta3, 3.0.0-beta4, 3.0.5]
Recommendation: Update to version 3.0.5.
GHSA-6784-9c82-vr85
Published date: 2024-10-03T18:26:26Z
CVE: CVE-2024-47617
Links:
- https://github.com/sulu/sulu/security/advisories/GHSA-6784-9c82-vr85
- https://nvd.nist.gov/vuln/detail/CVE-2024-47617
- https://github.com/sulu/sulu/commit/a5a5ae555d282e88ff8559d38cfb46dea7939bda
- https://github.com/sulu/sulu/commit/eeacd14b6cf55f710084788140d40ebb00314b29
- https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php#L106
- https://github.com/advisories/GHSA-6784-9c82-vr85
Injection of arbitrary HTML/JavaScript code through the media download URL
Impact
This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting (XSS) issue, which could potentially allow attackers to steal sensitive information, manipulate the website's content, or perform actions on behalf of the victim.
Patches
The problem has not been patched yet. Users should upgrade to patched versions once they become available. Currently affected versions are:
- 2.6.4
- 2.5.20
Workarounds
Until an official patch is released, users can implement additional input validation and output encoding for the 'slug' parameter in the MediaStreamController's downloadAction method. Alternatively, configuring a Web Application Firewall (WAF) to filter potentially malicious input could serve as a temporary mitigation.
References
- GitHub repository: https://github.com/sulu/sulu
- Vulnerable code: https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php#L106
Affected versions: ["2.5.20", "2.5.19", "2.5.18", "2.5.17", "2.5.16", "2.5.15", "2.5.14", "2.5.13", "2.5.12", "2.5.11", "2.5.10", "2.5.9", "2.5.8", "2.5.7", "2.5.6", "2.5.5", "2.5.4", "2.5.3", "2.5.2", "2.5.1", "2.5.0", "2.5.0-alpha1", "2.4.20", "2.4.19", "2.4.18", "2.4.17", "2.4.16", "2.4.15", "2.4.14", "2.4.13", "2.4.12", "2.4.11", "2.4.10", "2.4.9", "2.4.8", "2.4.7", "2.4.6", "2.4.5", "2.4.4", "2.4.3", "2.4.2", "2.4.1", "2.4.0", "2.4.0-RC1", "2.3.13", "2.3.12", "2.3.11", "2.3.10", "2.3.9", "2.3.8", "2.3.7", "2.3.6", "2.3.5", "2.3.4", "2.3.3", "2.3.2", "2.3.1", "2.3.0", "2.3.0-RC2", "2.3.0-RC1", "2.2.19", "2.2.18", "2.2.17", "2.2.16", "2.2.15", "2.2.14", "2.2.13", "2.2.12", "2.2.11", "2.2.10", "2.2.9", "2.2.8", "2.2.7", "2.2.6", "2.2.5", "2.2.4", "2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.2.0-RC1", "2.1.14", "2.1.13", "2.1.12", "2.1.11", "2.1.10", "2.1.9", "2.1.8", "2.1.7", "2.1.6", "2.1.5", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.1.0-RC2", "2.1.0-RC1", "2.0.12", "2.0.11", "2.0.10", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0", "2.6.4", "2.6.3", "2.6.2", "2.6.1", "2.6.0"]
Secure versions: [2.6.22, 3.0.0-RC1, 3.0.0-RC2, 3.0.0-alpha3, 3.0.0-alpha4, 3.0.0-alpha5, 3.0.0-beta1, 3.0.0-beta2, 3.0.0-beta3, 3.0.0-beta4, 3.0.5]
Recommendation: Update to version 3.0.5.
GHSA-6h7h-m7p5-hjqp
Published date: 2026-03-30T18:04:10Z
CVE: CVE-2026-34372
Links:
Sulu checks fix permissions for subentities endpoints
Impact
A user which has permission for the Sulu Admin via atleast one role could have access to the subentities of contacts via the admin API without even have permission for contacts.
Patches
The issue was patched in release 2.6.22 and 3.0.5.
Workarounds
Create a Symfony Request Listener checking the permissions for the specific roles.
Resources
Github Advisory: https://github.com/sulu/sulu/security/advisories/GHSA-6h7h-m7p5-hjqp
Affected versions: ["3.0.4", "3.0.3", "3.0.2", "3.0.1", "3.0.0", "2.6.21", "2.6.20", "2.6.19", "2.6.18", "2.6.17", "2.6.16", "2.6.15", "2.6.14", "2.6.13", "2.6.12", "2.6.11", "2.6.10", "2.6.9", "2.6.8", "2.6.7", "2.6.6", "2.6.5", "2.6.4", "2.6.3", "2.6.2", "2.6.1", "2.6.0", "2.6.0-RC2", "2.6.0-RC1", "2.5.33", "2.5.32", "2.5.31", "2.5.30", "2.5.29", "2.5.28", "2.5.27", "2.5.26", "2.5.25", "2.5.24", "2.5.23", "2.5.22", "2.5.21", "2.5.20", "2.5.19", "2.5.18", "2.5.17", "2.5.16", "2.5.15", "2.5.14", "2.5.13", "2.5.12", "2.5.11", "2.5.10", "2.5.9", "2.5.8", "2.5.7", "2.5.6", "2.5.5", "2.5.4", "2.5.3", "2.5.2", "2.5.1", "2.5.0", "2.5.0-alpha1", "2.4.20", "2.4.19", "2.4.18", "2.4.17", "2.4.16", "2.4.15", "2.4.14", "2.4.13", "2.4.12", "2.4.11", "2.4.10", "2.4.9", "2.4.8", "2.4.7", "2.4.6", "2.4.5", "2.4.4", "2.4.3", "2.4.2", "2.4.1", "2.4.0", "2.4.0-RC1", "2.3.13", "2.3.12", "2.3.11", "2.3.10", "2.3.9", "2.3.8", "2.3.7", "2.3.6", "2.3.5", "2.3.4", "2.3.3", "2.3.2", "2.3.1", "2.3.0", "2.3.0-RC2", "2.3.0-RC1", "2.2.19", "2.2.18", "2.2.17", "2.2.16", "2.2.15", "2.2.14", "2.2.13", "2.2.12", "2.2.11", "2.2.10", "2.2.9", "2.2.8", "2.2.7", "2.2.6", "2.2.5", "2.2.4", "2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.2.0-RC1", "2.1.14", "2.1.13", "2.1.12", "2.1.11", "2.1.10", "2.1.9", "2.1.8", "2.1.7", "2.1.6", "2.1.5", "2.1.4", "2.1.3", "2.1.2", "2.1.1", "2.1.0", "2.1.0-RC2", "2.1.0-RC1", "2.0.12", "2.0.11", "2.0.10", "2.0.9", "2.0.8", "2.0.7", "2.0.6", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0", "2.0.0-RC3", "2.0.0-RC2", "2.0.0-RC1", "2.0.0-alpha6", "2.0.0-alpha5", "2.0.0-alpha4", "2.0.0-alpha3", "2.0.0-alpha2", "2.0.0-alpha1", "1.6.46", "1.6.45", "1.6.44", "1.6.43", "1.6.42", "1.6.41", "1.6.40", "1.6.39", "1.6.38", "1.6.37", "1.6.36", "1.6.35", "1.6.34", "1.6.33", "1.6.32", "1.6.31", "1.6.30", "1.6.29", "1.6.28", "1.6.27", "1.6.26", "1.6.25", "1.6.24", "1.6.23", "1.6.22", "1.6.21", "1.6.20", "1.6.19", "1.6.18", "1.6.17", "1.6.16", "1.6.15", "1.6.14", "1.6.13", "1.6.12", "1.6.11", "1.6.10", "1.6.9", "1.6.8", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.3", "1.6.2", "1.6.1", "1.6.0", "1.6.0-RC1", "1.5.24", "1.5.23", "1.5.22", "1.5.21", "1.5.20", "1.5.19", "1.5.18", "1.5.17", "1.5.16", "1.5.15", "1.5.14", "1.5.13", "1.5.12", "1.5.11", "1.5.10", "1.5.9", "1.5.8", "1.5.7", "1.5.6", "1.5.5", "1.5.4", "1.5.3", "1.5.2", "1.5.1", "1.5.0", "1.5.0-RC3", "1.5.0-RC2", "1.5.0-RC1", "1.4.12", "1.4.11", "1.4.10", "1.4.9", "1.4.8", "1.4.7", "1.4.6", "1.4.5", "1.4.4", "1.4.3", "1.4.2", "1.4.1", "1.4.0", "1.4.0-RC2", "1.4.0-RC1", "1.3.11", "1.3.10", "1.3.9", "1.3.8", "1.3.7", "1.3.6", "1.3.5", "1.3.4", "1.3.3", "1.3.2", "1.3.1", "1.3.0", "1.3.0-RC3", "1.3.0-RC2", "1.3.0-RC1", "1.2.9", "1.2.8", "1.2.7", "1.2.6", "1.2.5", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.2.0", "1.2.0-RC4", "1.2.0-RC3", "1.2.0-RC2", "1.2.0-RC1", "1.1.12", "1.1.11", "1.1.10", "1.1.9", "1.1.8", "1.1.7", "1.1.6", "1.1.5", "1.1.4", "1.1.3", "1.1.2", "1.1.1", "1.1.0", "1.1.0-RC2", "1.1.0-RC1", "1.1.0-beta1", "1.0.15", "1.0.14", "1.0.13", "1.0.12", "1.0.11", "1.0.10", "1.0.9", "1.0.8", "1.0.7", "1.0.6", "1.0.5", "1.0.4", "1.0.3", "1.0.2", "1.0.1", "1.0.0"]
Secure versions: [2.6.22, 3.0.0-RC1, 3.0.0-RC2, 3.0.0-alpha3, 3.0.0-alpha4, 3.0.0-alpha5, 3.0.0-beta1, 3.0.0-beta2, 3.0.0-beta3, 3.0.0-beta4, 3.0.5]
Recommendation: Update to version 3.0.5.
381 Other Versions
| Version | License | Security | Released | |
|---|---|---|---|---|
| 3.0.5 | MIT | 2026-03-27 - 14:15 | 28 days | |
| 3.0.4 | MIT | 1 | 2026-02-12 - 18:02 | 2 months |
| 3.0.3 | MIT | 1 | 2026-01-16 - 11:55 | 3 months |
| 3.0.2 | MIT | 1 | 2026-01-09 - 12:41 | 4 months |
| 3.0.1 | MIT | 1 | 2025-12-23 - 08:58 | 4 months |
| 3.0.0 | MIT | 1 | 2025-11-25 - 23:52 | 5 months |
| 3.0.0-RC2 | MIT | 2025-11-24 - 11:26 | 5 months | |
| 3.0.0-RC1 | MIT | 2025-11-14 - 19:45 | 5 months | |
| 3.0.0-beta4 | MIT | 2025-11-07 - 10:03 | 6 months | |
| 3.0.0-beta3 | MIT | 2025-10-28 - 16:19 | 6 months | |
| 3.0.0-beta2 | MIT | 2025-10-22 - 08:03 | 6 months | |
| 3.0.0-beta1 | MIT | 2025-09-10 - 09:33 | 8 months | |
| 3.0.0-alpha5 | MIT | 2025-08-20 - 13:33 | 8 months | |
| 3.0.0-alpha4 | MIT | 2025-07-16 - 16:18 | 9 months | |
| 3.0.0-alpha3 | MIT | 2025-05-14 - 12:54 | 12 months | |
| 3.0.0-alpha2 | MIT | 1 | 2025-04-24 - 12:22 | about 1 year |
| 3.0.0-alpha1 | MIT | 1 | 2025-04-10 - 11:27 | about 1 year |
| 2.6.22 | MIT | 2026-03-27 - 14:13 | 28 days | |
| 2.6.21 | MIT | 1 | 2026-02-12 - 17:47 | 2 months |
| 2.6.20 | MIT | 1 | 2026-01-16 - 11:51 | 3 months |
| 2.6.19 | MIT | 1 | 2026-01-09 - 12:41 | 4 months |
| 2.6.18 | MIT | 1 | 2025-12-23 - 08:36 | 4 months |
| 2.6.17 | MIT | 1 | 2025-11-22 - 15:13 | 5 months |
| 2.6.16 | MIT | 1 | 2025-11-14 - 08:13 | 5 months |
| 2.6.15 | MIT | 1 | 2025-11-07 - 09:49 | 6 months |
| 2.6.14 | MIT | 1 | 2025-10-28 - 13:21 | 6 months |
| 2.6.13 | MIT | 1 | 2025-10-22 - 07:48 | 6 months |
| 2.6.12 | MIT | 1 | 2025-09-09 - 14:35 | 8 months |
| 2.6.11 | MIT | 1 | 2025-08-20 - 13:08 | 8 months |
| 2.6.10 | MIT | 1 | 2025-07-16 - 15:13 | 9 months |
| 2.6.9 | MIT | 1 | 2025-05-14 - 12:53 | 12 months |
| 2.6.8 | MIT | 2 | 2025-04-10 - 07:39 | about 1 year |
| 2.6.7 | MIT | 2 | 2025-02-05 - 17:10 | about 1 year |
| 2.6.6 | MIT | 2 | 2024-11-27 - 12:35 | over 1 year |
| 2.6.5 | MIT | 2 | 2024-10-02 - 14:49 | over 1 year |
| 2.6.4 | MIT | 3 | 2024-07-25 - 12:21 | over 1 year |
| 2.6.3 | MIT | 3 | 2024-06-27 - 11:28 | almost 2 years |
| 2.6.2 | MIT | 3 | 2024-05-16 - 13:38 | almost 2 years |
| 2.6.1 | MIT | 3 | 2024-05-06 - 09:28 | almost 2 years |
| 2.6.0 | MIT | 3 | 2024-05-02 - 13:36 | almost 2 years |
| 2.6.0-RC2 | MIT | 2 | 2024-04-15 - 16:15 | about 2 years |
| 2.6.0-RC1 | MIT | 2 | 2024-03-29 - 08:34 | about 2 years |
| 2.5.33 | MIT | 1 | 2025-11-22 - 15:12 | 5 months |
| 2.5.32 | MIT | 1 | 2025-11-07 - 12:19 | 6 months |
| 2.5.31 | MIT | 1 | 2025-11-07 - 09:05 | 6 months |
| 2.5.30 | MIT | 1 | 2025-10-28 - 12:14 | 6 months |
| 2.5.29 | MIT | 1 | 2025-10-22 - 07:44 | 6 months |
| 2.5.28 | MIT | 1 | 2025-09-08 - 06:46 | 8 months |
| 2.5.27 | MIT | 1 | 2025-08-20 - 13:04 | 8 months |
| 2.5.26 | MIT | 1 | 2025-07-16 - 14:26 | 9 months |