PT-2025-21177 · Sulu · Sulu

Published 2025-05-14 · Updated 2025-05-15 · CVE-2025-47778

Positive Technologies (AI Summary)

CVSS v4.0

6.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: Sulu versions 2.5.21 through 2.5.24 Sulu versions 2.6.5 through 2.6.8 Sulu versions 3.0.0-alpha1 through 3.0.0-alpha2

Description: Sulu is an open-source PHP content management system based on the Symfony framework. The issue allows an admin user to upload SVG files, which may load external data via the XML DOM library, potentially leading to insecure XML External Entity References.

Recommendations: For versions 2.5.21 through 2.5.24, update to version 2.5.25 or later. For versions 2.6.5 through 2.6.8, update to version 2.6.9 or later. For versions 3.0.0-alpha1 through 3.0.0-alpha2, update to version 3.0.0-alpha3 or later. As a temporary workaround, one may manually patch the effect file src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2025-47778

GHSA-F6RX-HF55-4255

Affected Products

Sulu

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47778.json · Exploit
• https://osv.dev/vulnerability/GHSA-f6rx-hf55-4255 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-47778 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47778 · Security Note
• https://github.com/sulu/sulu · Note
• https://github.com/sulu/sulu/security/advisories/GHSA-f6rx-hf55-4255 · Note
• https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/FileInspector/SvgFileInspector.php · Note
• https://github.com/sulu/sulu/commit/02f52fca04eb9495b9b4a0c5cc64cf23bc27f544 · Note
• https://t.me/cvetracker/23845 · Telegram Post
• https://twitter.com/CVEnew/status/1922695629052182732 · Twitter Post