Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-82396, describes a Stored XSS issue in Sulu where an attacker could upload a malicious HTML/XML file and force it to be rendered inline by the browser on the Sulu origin. This was possible because the application honored an inline query parameter for certain scriptable MIME types (specifically text/html, application/xhtml+xml, text/xml, and application/xml), instead of always forcing a download. The provided commit d061094f5b7bb1d5e974544fce30bede9c7adf8e directly addresses this issue.
Upon analyzing the diff for src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php, the createBinaryFileResponse function is identified as the core vulnerable component. Before the patch, this function was responsible for creating and sending the file response, including setting the Content-Disposition header. It lacked the necessary logic to identify and mitigate dangerous MIME types when the inline parameter was requested. The patch introduces a new constant DANGEROUS_INLINE_MIME_TYPES and a helper function isDangerousInlineMimeType to detect these types. Crucially, within createBinaryFileResponse, if a dangerous MIME type is detected and an inline disposition is requested, the dispositionType is explicitly changed to attachment. Additionally, a Content-Security-Policy: sandbox header is added to further mitigate potential risks. Therefore, the createBinaryFileResponse function is the function that contained the vulnerability, as it was directly modified to implement the fix and prevent the inline rendering of malicious content. When the vulnerability was exploited, the execution flow would pass through createBinaryFileResponse, which would then incorrectly set the Content-Disposition header, leading to the XSS.
MediaStreamController::createBinaryFileResponsesrc/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sulu/sulu | composer | <= 2.6.24 | 2.6.25 |
| sulu/sulu | composer | >= 3.0.0-alpha1, < 3.0.8 | 3.0.8 |