| Version | Supported |
|---|---|
| >= 2.5.0 | ✅ |
| 2.0 - 2.4 | ❌ |
| 1.6.x | ✅ |
| < 1.6 | ❌ |
See also documentation about the Release Cycle.
You can contact us for security related issues by using security@sulu.io.
Security: sulu/sulu
Security
SECURITY.md
8FF5-
XXE in SVG File upload InspectorGHSA-f6rx-hf55-4255 published
May 14, 2025 by alexander-schranzModerate -
Inject arbitrary HTML/JavaScript code through the media download URLGHSA-6784-9c82-vr85 published
Oct 3, 2024 by wachterjohannesModerate -
Access to pages is granted regardless of role permissionsGHSA-jr83-m233-gg6p published
Mar 4, 2024 by alexander-schranzModerate -
HTML Injection via Autocomplete SuggestionGHSA-gfrh-gwqc-63cv published
Feb 5, 2024 by alexander-schranzLow -
Observable Response Discrepancy on Admin LoginGHSA-wmwf-49vv-p3mr published
Aug 3, 2023 by alexander-schranzModerate -
XSS via uploaded SVGGHSA-255w-87rh-rg44 published
Oct 3, 2024 by wachterjohannesModerate -
Privilege escalation in the Sulu Admin panelGHSA-84px-q68r-2fc9 published
Dec 15, 2021 by alexander-schranzModerate -
PHP file inclusion in the Sulu admin panelGHSA-vx6j-pjrh-vgjh published
Dec 15, 2021 by alexander-schranzModerate -
XSS injection in Tag autocomplete was possibleGHSA-h58v-g3q6-q9fx published
Oct 21, 2021 by alexander-schranzLow -
XSS Injection in Media Collection Title was possibleGHSA-gm2x-6475-g9r8 published
Jul 2, 2021 by alexander-schranzLow
Learn more about advisories related to sulu/sulu in the GitHub Advisory Database