THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-pp4x-ccxq-6r33 (medium) — Sulu: Stored XSS via media download inline-disposition override

[GHSA] GHSA-pp4x-ccxq-6r33 (medium) — Sulu: Stored XSS via media download inline-disposition override

medgithub_advisoriesPublished 2026-09-02

GHSA-pp4x-ccxq-6r33 Severity: medium CVE: CVE-2026-82396

Sulu: Stored XSS via media download inline-disposition override

### Impact

Stored Cross Site Scripting (XSS) in the media download endpoint.

The download route (`/media/{id}/download/{slug}` and its admin variant) accepts the query parameter `?inline=1`. When it is present, the response is sent with the header `Content-Disposition: inlin

MITRE ATT&CK techniques

JavaScriptT1059.007
CredentialsT1589.001

Indicators of compromise

CVE-2026-82396cve
CVE-2024-47617cve

Original source: https://github.com/advisories/GHSA-pp4x-ccxq-6r33