CVE-2021-41169
Improper Neutralization HTML tags in sulu/sulu
Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags. Users are advised to upgrade.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper Neutralization HTML tags in sulu/sulu
Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags. Users are advised to upgrade.
- Record
CVE-2021-41169- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2021-2208
Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags. Users are advised to upgrade.
- Record
EUVD-2021-2208- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h58v-g3q6-q9fx
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in sulu/sulu
Impact
What kind of vulnerability is it? Who is impacted?
It is an issue when input HTML into the Tag name. The HTML is execute when the tag name is listed in the auto complete form. Only admin users are affected and only admin users can create tags.
Patches
Has the problem been patched? What versions should users upgrade to?
The problem is patched with Version 1.6.42.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Create a custom request listener to avoid that this kind of tags are created.
References
Are there any links users can visit to find out more?
Currently not.
For more information
If you have any questions or comments about this advisory:
- Open an issue in sulu/sulu repository
- Email us at [email protected]
- Record
GHSA-h58v-g3q6-q9fx- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags. Users are advised to upgrade.
- Record
CVE-2021-41169- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N - CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags. Users are advised to upgrade.
- Record
CVE-2021-41169- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-h58v-g3q6-q9fx
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in sulu/sulu
Impact
What kind of vulnerability is it? Who is impacted?
It is an issue when input HTML into the Tag name. The HTML is execute when the tag name is listed in the auto complete form. Only admin users are affected and only admin users can create tags.
Patches
Has the problem been patched? What versions should users upgrade to?
The problem is patched with Version 1.6.42.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Create a custom request listener to avoid that this kind of tags are created.
References
Are there any links users can visit to find out more?
Currently not.
For more information
If you have any questions or comments about this advisory:
- Open an issue in sulu/sulu repository
- Email us at [email protected]
- Record
GHSA-h58v-g3q6-q9fx- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sulu/suluPackagist |
before 1.6.43 | 1.6.43 |
sulu/suluPackagist |
before 1.6.43, plus listed versions 0.1.00.1.10.10.00.10.10.10.2 Show 45 moreShow less0.11.00.11.10.11.20.12.00.13.00.13.10.13.20.14.00.14.10.14.20.15.00.15.10.15.20.15.30.16.00.16.10.16.20.17.00.17.0-RC10.17.0-RC20.18.00.18.10.18.20.2.00.3.00.4.00.5.00.6.00.6.10.6.20.6.30.6.40.6.50.6.60.6.70.6.80.7.00.7.10.8.00.8.10.8.20.8.30.8.40.8.50.8.6 |
1.6.43 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-41169 is a medium vulnerability (CVSS 6.2) in Sulu, published October 21, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in sulu/sulu 1.6.43.
References
Left out here: 152 versions. The JSON record has them.