TI-2021-19642 Aliases CVE-2021-43836 GHSA-vx6j-pjrh-vgjh

PHP file inclusion in the Sulu admin panel

MEDIUM 42CWE-22Published 2021-12-15 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions an attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution. The problem is patched with the Versions 1.6.44, 2.2.18, 2.3.8, 2.4.0. For users unable to upgrade overwrite the service `sulu_route.generator.expression_token_provider` and wrap the translator before passing it to the expression language.

Why it matters now

EPSS 0.02047 81st percentileScored 2026-11-07

Fix Fixed sulu (sulu): 1.6.44, 2.2.18, 2.3.8sulu/sulu (Packagist): 1.6.44, 2.2.18, 2.3.8 +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
sulu	sulu	before 1.6.44; 2.0.0 to before 2.2.18; 2.3.0 to before 2.3.8	1.6.44, 2.2.18, 2.3.8	Patch available	CNA
—	sulu/sulu (Packagist)	before 1.6.44	1.6.44	Patch available	GHSA-vx6j-pjrh-vgjh
—	sulu/sulu (Packagist)	2.0.0 to before 2.2.18	2.2.18	Patch available	GHSA-vx6j-pjrh-vgjh
—	sulu/sulu (Packagist)	2.3.0 to before 2.3.8	2.3.8	Patch available	GHSA-vx6j-pjrh-vgjh
—	sulu/sulu (Packagist)	2.4.0-RC1 to before 2.4.0	2.4.0	Patch available	GHSA-vx6j-pjrh-vgjh

sulu Vendorsulu Affected before 1.6.44; 2.0.0 to before 2.2.18; 2.3.0 to before 2.3.8 Fixed in 1.6.44, 2.2.18, 2.3.8 Patch available CNA
sulu/sulu (Packagist) Vendor— Affected before 1.6.44 Fixed in 1.6.44 Patch available GHSA-vx6j-pjrh-vgjh
sulu/sulu (Packagist) Vendor— Affected 2.0.0 to before 2.2.18 Fixed in 2.2.18 Patch available GHSA-vx6j-pjrh-vgjh
sulu/sulu (Packagist) Vendor— Affected 2.3.0 to before 2.3.8 Fixed in 2.3.8 Patch available GHSA-vx6j-pjrh-vgjh
sulu/sulu (Packagist) Vendor— Affected 2.4.0-RC1 to before 2.4.0 Fixed in 2.4.0 Patch available GHSA-vx6j-pjrh-vgjh

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:sulu:sulu::::::::	before 1.6.44; 2.0.0 to before 2.2.18; 2.3.0 to before 2.3.8	Vulnerable	sulu
cpe:2.3:a:sulu:sulu:2.4.0:rc1::::::	2.4.0 rc1	Vulnerable	sulu

cpe:2.3:a:sulu:sulu:*:*:*:*:*:*:*:* Versions before 1.6.44; 2.0.0 to before 2.2.18; 2.3.0 to before 2.3.8 Vulnerable ·sulu
cpe:2.3:a:sulu:sulu:2.4.0:rc1:*:*:*:*:*:* Versions 2.4.0 rc1 Vulnerable ·sulu

Remediation

Fix · CNA sulu (sulu) Fixed in 1.6.44, 2.2.18, 2.3.8
Fix · GHSA-vx6j-pjrh-vgjh sulu/sulu (Packagist) Fixed in 1.6.44 Advisory →
Fix · GHSA-vx6j-pjrh-vgjh sulu/sulu (Packagist) Fixed in 2.2.18 Advisory →
Fix · GHSA-vx6j-pjrh-vgjh sulu/sulu (Packagist) Fixed in 2.3.8 Advisory →
Fix · GHSA-vx6j-pjrh-vgjh sulu/sulu (Packagist) Fixed in 2.4.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-43836
2026-10-03 Alias added: GHSA-vx6j-pjrh-vgjh

References

Patch 1

https://github.com/sulu/sulu/commit/9c948f9ce350c68b53af8c3910e2cefc7f722b54

Advisory 2

Other 1

https://github.com/sulu/sulu

TI-2024-18520 Sulu grants access to pages regardless of role permissions CVSS 3.1HIGH 8.1
TI-2021-12405 XSS Injection in Media Collection Title was possible CVSS 3.1HIGH 8.4
TI-2021-19641 Privilege escalation in the Sulu Admin panel CVSS 3.1HIGH 7.2
TI-2021-18008 Improper Neutralization HTML tags in sulu/sulu CVSS 3.1MEDIUM 6.2
TI-2024-31897 Reflected XSS Vulnerability in Sulu Media Bundle CVSS 3.1MEDIUM 6.1
TI-2020-11905 Reset Password / Login vulnerability in Sulu CVSS 3.1MEDIUM 5.3

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences