Sulu: Stored XSS via media download inline-disposition override

Impact Stored Cross Site Scripting XSS in the media download endpoint. The download route /media/id/download/slug and its admin variant accepts the query parameter ?inline=1. When it is present, the response is sent with the header Content-Disposition: inline for any MIME type, which overrides th...

CVE-2026-82396

Sulu , an open-source PHP CMS built on Symfony, is affected by a stored XSS in MediaStreamController.php prior to versions 2.6.25 and 3.0.8 . The /media/{id}/download/{slug} route honors the inline=1 query parameter for scriptable MIME types (text/html, application/xhtml+xml, text/xml, applicatio...