CVE-2024-47618: Sulu

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Sulu is a PHP content management system. Sulu is vulnerable against XSS whereas a low privileged user with access to the “Media” section can upload an SVG file with a malicious payload. Once uploaded and accessed, the malicious javascript will be executed on the victims’ (other users including admins) browsers. This issue is fixed in 2.6.5.

Affected products

• Sulu Sulu: after 2.0.0, before 2.6.5 (fixed in 2.6.5); version 2.0.0 only

Published 2024-10-03. Last modified 2026-06-17.