TI-2021-18008 Aliases CVE-2021-41169 GHSA-h58v-g3q6-q9fx

Improper Neutralization HTML tags in sulu/sulu

LOW 28CWE-79Published 2021-10-21 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: High
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags. Users are advised to upgrade.

Why it matters now

EPSS 0.00591 48th percentileScored 2026-11-07

Fix Fixed sulu (sulu): 1.6.43sulu/sulu (Packagist): 1.6.43

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
sulu	sulu	before 1.6.43	1.6.43	Patch available	CNA
—	sulu/sulu (Packagist)	before 1.6.43	1.6.43	Patch available	GHSA-h58v-g3q6-q9fx

sulu Vendorsulu Affected before 1.6.43 Fixed in 1.6.43 Patch available CNA
sulu/sulu (Packagist) Vendor— Affected before 1.6.43 Fixed in 1.6.43 Patch available GHSA-h58v-g3q6-q9fx

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sulu:sulu::::::::	before 1.6.43	Vulnerable	sulu

cpe:2.3:a:sulu:sulu:*:*:*:*:*:*:*:* Versions before 1.6.43 Vulnerable ·sulu

Remediation

Fix · CNA sulu (sulu) Fixed in 1.6.43
Fix · GHSA-h58v-g3q6-q9fx sulu/sulu (Packagist) Fixed in 1.6.43 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-41169
2026-10-03 Alias added: GHSA-h58v-g3q6-q9fx

References

Patch 1

https://github.com/sulu/sulu/commit/20007ac70a3af3c9e53a6acb0ef8794b65642445

Advisory 2

Other 1

https://github.com/sulu/sulu

TI-2021-19642 PHP file inclusion in the Sulu admin panel CVSS 3.1HIGH 8.8
TI-2024-18520 Sulu grants access to pages regardless of role permissions CVSS 3.1HIGH 8.1
TI-2021-12405 XSS Injection in Media Collection Title was possible CVSS 3.1HIGH 8.4
TI-2021-19641 Privilege escalation in the Sulu Admin panel CVSS 3.1HIGH 7.2
TI-2024-31897 Reflected XSS Vulnerability in Sulu Media Bundle CVSS 3.1MEDIUM 6.1
TI-2020-11905 Reset Password / Login vulnerability in Sulu CVSS 3.1MEDIUM 5.3

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences