Sulu is a PHP CMS that allows media uploads. Prior to the 2.6.25 and 3.0.8 releases, the media download route honored an inline query parameter for scriptable MIME types such as text/html and application/xml. When a user with upload permission stores an HTML, XHTML, or XML document and creates a link with inline=1, the server returns the file with a normal inline disposition. An authenticated victim who opens the link is exposed to attacker‑controlled JavaScript that runs with the victim’s session, enabling the attacker to read data or perform actions on the victim’s behalf.

Any installation of Sulu that has not been upgraded past version 2.6.25 or 3.0.8 is vulnerable. The issue affects the public media download endpoint and its administration variant, both hosted at /media/{id}/download/{slug}.

The CVSS score of 5.4 indicates moderate impact. No EPSS data is available and the vulnerability is not listed in CISA KEV. Exploitation requires an attacker to possess media upload rights, store malicious content, and then lures a legitimate user into opening a crafted download link. Because the attack relies on a stored cross‑site script that is delivered from the Sulu origin, the attacker must first be able to upload malicious media or abuse an existing upload account.