Sulu vulnerable to XSS via uploaded SVG
Priority LOW 23CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Sulu is a PHP content management system. Sulu is vulnerable against XSS whereas a low privileged user with access to the “Media” section can upload an SVG file with a malicious payload. Once uploaded and accessed, the malicious javascript will be executed on the victims’ (other users including admins) browsers. This issue is fixed in 2.6.5.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0035 28th percentileScored 2026-11-07
Fix Fixed sulu (sulu): 2.5.21, 2.6.5sulu/sulu (Packagist): 2.5.21, 2.6.5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| sulu | sulu | 2.0.0-RC1 to before 2.5.21; 2.6.0-RC1 to before 2.6.5 | 2.5.21, 2.6.5 | Patch available | CNA |
| — | sulu/sulu (Packagist) | 2.0.0-RC1 to before 2.5.21 | 2.5.21 | Patch available | GHSA-255w-87rh-rg44 |
| — | sulu/sulu (Packagist) | 2.6.0-RC1 to before 2.6.5 | 2.6.5 | Patch available | GHSA-255w-87rh-rg44 |
- sulu Vendorsulu Affected 2.0.0-RC1 to before 2.5.21; 2.6.0-RC1 to before 2.6.5 Fixed in 2.5.21, 2.6.5 Patch available CNA
- sulu/sulu (Packagist) Vendor— Affected 2.0.0-RC1 to before 2.5.21 Fixed in 2.5.21 Patch available GHSA-255w-87rh-rg44
- sulu/sulu (Packagist) Vendor— Affected 2.6.0-RC1 to before 2.6.5 Fixed in 2.6.5 Patch available GHSA-255w-87rh-rg44
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sulu:sulu:*:*:*:*:*:*:*:* | after 2.0.0, before 2.6.5 | Vulnerable | sulu |
| cpe:2.3:a:sulu:sulu:2.0.0:-:*:*:*:*:*:* | 2.0.0 | Vulnerable | sulu |
| cpe:2.3:a:sulu:sulu:2.0.0:rc1:*:*:*:*:*:* | 2.0.0 rc1 | Vulnerable | sulu |
| cpe:2.3:a:sulu:sulu:2.0.0:rc2:*:*:*:*:*:* | 2.0.0 rc2 | Vulnerable | sulu |
| cpe:2.3:a:sulu:sulu:2.0.0:rc3:*:*:*:*:*:* | 2.0.0 rc3 | Vulnerable | sulu |
- cpe:2.3:a:sulu:sulu:*:*:*:*:*:*:*:* Versions after 2.0.0, before 2.6.5 Vulnerable ·sulu
- cpe:2.3:a:sulu:sulu:2.0.0:-:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·sulu
- cpe:2.3:a:sulu:sulu:2.0.0:rc1:*:*:*:*:*:* Versions 2.0.0 rc1 Vulnerable ·sulu
- cpe:2.3:a:sulu:sulu:2.0.0:rc2:*:*:*:*:*:* Versions 2.0.0 rc2 Vulnerable ·sulu
- cpe:2.3:a:sulu:sulu:2.0.0:rc3:*:*:*:*:*:* Versions 2.0.0 rc3 Vulnerable ·sulu
Remediation
- Fix · CNA sulu (sulu) Fixed in 2.5.21, 2.6.5
- Fix · GHSA-255w-87rh-rg44 sulu/sulu (Packagist) Fixed in 2.5.21 Advisory →
- Fix · GHSA-255w-87rh-rg44 sulu/sulu (Packagist) Fixed in 2.6.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-47618
- 2026-10-03 Alias added: GHSA-255w-87rh-rg44
References
More Sulu vulnerabilities
- TI-2021-19642 PHP file inclusion in the Sulu admin panel CVSS 3.1HIGH 8.8
- TI-2024-18520 Sulu grants access to pages regardless of role permissions CVSS 3.1HIGH 8.1
- TI-2021-12405 XSS Injection in Media Collection Title was possible CVSS 3.1HIGH 8.4
- TI-2021-19641 Privilege escalation in the Sulu Admin panel CVSS 3.1HIGH 7.2
- TI-2021-18008 Improper Neutralization HTML tags in sulu/sulu CVSS 3.1MEDIUM 6.2
- TI-2024-31897 Reflected XSS Vulnerability in Sulu Media Bundle CVSS 3.1MEDIUM 6.1
Sources
- CVE-2024-47618 · CVE Program
- CVE-2024-47618 · NVD
- FIRST EPSS
- GHSA-255w-87rh-rg44 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences