CVE-2021-32737
XSS Injection in Media Collection Title was possible
Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for a logged in admin user to add a script injection (cross-site-scripting) in the collection title. The problem is patched in version 1.6.41. As a workaround, one may manually patch the affected JavaScript files in lieu of updating.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
XSS Injection in Media Collection Title was possible
Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for a logged in admin user to add a script injection (cross-site-scripting) in the collection title. The problem is patched in version 1.6.41. As a workaround, one may manually patch the affected JavaScript files in lieu of updating.
- Record
CVE-2021-32737- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2021-1467
Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for a logged in admin user to add a script injection (cross-site-scripting) in the collection title. The problem is patched in version 1.6.41. As a workaround, one may manually patch the affected JavaScript files in lieu of updating.
- Record
EUVD-2021-1467- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gm2x-6475-g9r8
XSS Injection in Media Collection Title was possible
Impact
A logged in admin user was possible to add a script injection (XSS) in the collection title which was executed.
Workarounds
Manual patching the js files.
For more information
If you have any questions or comments about this advisory:'
- Email us at [email protected]
- Record
GHSA-gm2x-6475-g9r8- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for a logged in admin user to add a script injection (cross-site-scripting) in the collection title. The problem is patched in version 1.6.41. As a workaround, one may manually patch the affected JavaScript files in lieu of updating.
- Record
CVE-2021-32737- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H - CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for a logged in admin user to add a script injection (cross-site-scripting) in the collection title. The problem is patched in version 1.6.41. As a workaround, one may manually patch the affected JavaScript files in lieu of updating.
- Record
CVE-2021-32737- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-gm2x-6475-g9r8
XSS Injection in Media Collection Title was possible
Impact
A logged in admin user was possible to add a script injection (XSS) in the collection title which was executed.
Workarounds
Manual patching the js files.
For more information
If you have any questions or comments about this advisory:'
- Email us at [email protected]
- Record
GHSA-gm2x-6475-g9r8- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sulu/suluPackagist |
before 1.6.41 | 1.6.41 |
sulu/suluPackagist |
before 1.6.41, plus listed versions 0.1.00.1.10.10.00.10.10.10.2 Show 45 moreShow less0.11.00.11.10.11.20.12.00.13.00.13.10.13.20.14.00.14.10.14.20.15.00.15.10.15.20.15.30.16.00.16.10.16.20.17.00.17.0-RC10.17.0-RC20.18.00.18.10.18.20.2.00.3.00.4.00.5.00.6.00.6.10.6.20.6.30.6.40.6.50.6.60.6.70.6.80.7.00.7.10.8.00.8.10.8.20.8.30.8.40.8.50.8.6 |
1.6.41 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-32737 is a high vulnerability (CVSS 8.4) in Sulu, published July 2, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 52nd percentile. Fixed in sulu/sulu 1.6.41.
References
Left out here: 150 versions. The JSON record has them.