sulu/sulu Security Advisories for 2.4.1 (11)
-
[MEDIUM] Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)
PKSA-mg6n-7v6r-wbcq CVE-2026-92692 GHSA-jg26-q8hg-3pq4
Affected version: >=3.0.0,<3.0.8|<2.6.25
Reported by:
GitHub -
[MEDIUM] Sulu: Stored XSS via media download inline-disposition override
PKSA-nbbf-nf63-19vd CVE-2026-82396 GHSA-pp4x-ccxq-6r33
Affected version: >=3.0.0-alpha1,<3.0.8|<=2.6.24
Reported by:
GitHub -
[MEDIUM] Sulu: Fix authorization bypass when creating preview links
PKSA-2gwf-7fts-yzvv CVE-2026-82394 GHSA-65cv-w493-7vhq
Affected version: >=3.0.0-alpha1,<3.0.8|<=2.6.24
Reported by:
GitHub -
[MEDIUM] Sulu: Media move/update authorization bypass (IDOR)
PKSA-zmfc-sgjt-9gmb CVE-2026-82395 GHSA-h6cx-gjxx-v25c
Affected version: >=3.0.0-alpha1,<3.0.8|<=2.6.24
Reported by:
GitHub -
[LOW] Sulu: Used API Keys may be available via Admin API
PKSA-2mt7-sd38-1xng GHSA-9m6v-8fxc-4r44
Affected version: <=2.6.22|>=3.0.0-alpha1,<=3.0.5
Reported by:
GitHub -
[MEDIUM] Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens
PKSA-psv3-gm5n-8wm5 CVE-2026-45701 GHSA-7fv8-6pp7-6h85
Affected version: <=2.6.22|>=3.0.0-alpha1,<=3.0.5
Reported by:
GitHub -
[MEDIUM] Sulu checks fix permissions for subentities endpoints
PKSA-s8fv-tzzv-5y3k CVE-2026-34372 GHSA-6h7h-m7p5-hjqp
Affected version: >=3.0.0,<3.0.5|>=1.0.0,<2.6.22
Reported by:
GitHub -
[MEDIUM] Injection of arbitrary HTML/JavaScript code through the media download URL
PKSA-g1w7-pdzy-w7y7 CVE-2024-47617 GHSA-6784-9c82-vr85
Affected version: >=2.0.0,<=2.5.20|>=2.6.0,<=2.6.4
Reported by:
GitHub -
[MEDIUM] Cross-site Scripting via uploaded SVG
PKSA-mxjr-c7nk-459v CVE-2024-47618 GHSA-255w-87rh-rg44
Affected version: >=2.6.0-RC1,<2.6.5|>=2.0.0-RC1,<2.5.21
Reported by:
GitHub -
[MEDIUM] Sulu grants access to pages regardless of role permissions
PKSA-ykzr-rw85-c27h CVE-2024-27915 GHSA-jr83-m233-gg6p
Affected version: >=2.5.0-alpha1,<2.5.13|>=2.2.0,<2.4.17
Reported by:
GitHub -
[LOW] Sulu HTML Injection via Autocomplete Suggestion
PKSA-1zxy-qsnv-h3z4 CVE-2024-24807 GHSA-gfrh-gwqc-63cv
Affected version: >=2.5.0,<2.5.12|>=2.0.0,<2.4.16
Reported by:
GitHub