Every CVE Search/ Get API key

CVE-2021-43836

PHP file inclusion in the Sulu admin panel

8.5 HighFix available

Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions an attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution. The problem is patched with the Versions 1.6.44, 2.2.18, 2.3.8, 2.4.0. For users unable to upgrade overwrite the service sulu_route.generator.expression_token_provider and wrap the translator before passing it to the expression language.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.05%Up 0.7 points since Dec 16, 2021
90%50%10%1%

What each source reports

CVE List Score used 8.5

PHP file inclusion in the Sulu admin panel

Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions an attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution. The problem is patched with the Versions 1.6.44, 2.2.18, 2.3.8, 2.4.0. For users unable to upgrade overwrite the service sulu_route.generator.expression_token_provider and wrap the translator before passing it to the expression language.

Record
CVE-2021-43836
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2021-2597 8.5

Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions an attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution. The problem is patched with the Versions 1.6.44, 2.2.18, 2.3.8, 2.4.0. For users unable to upgrade overwrite the service sulu_route.generator.expression_token_provider and wrap the translator before passing it to the expression language.

Record
EUVD-2021-2597
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-vx6j-pjrh-vgjh 8.5

PHP file inclusion in the Sulu admin panel

Impact

What kind of vulnerability is it? Who is impacted?

An attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution.

  • Compromised components: Arbitrary file read on the server, (Potential) Remote code execution
  • Exploitation pre-requisite: User account on the backend

Patches

Has the problem been patched? What versions should users upgrade to?

The problem is patched with the Versions 1.6.44, 2.2.18, 2.3.8, 2.4.0

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Overwrite the service sulu_route.generator.expression_token_provider and wrap the translator before passing it to the expression language.

References

Are there any links users can visit to find out more?

Currently not.

For more information

If you have any questions or comments about this advisory:

Record
GHSA-vx6j-pjrh-vgjh
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
NVD 8.5

Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions an attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution. The problem is patched with the Versions 1.6.44, 2.2.18, 2.3.8, 2.4.0. For users unable to upgrade overwrite the service sulu_route.generator.expression_token_provider and wrap the translator before passing it to the expression language.

Record
CVE-2021-43836
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-22
Updated
2026-11-02
OSV 8.8

Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions an attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution. The problem is patched with the Versions 1.6.44, 2.2.18, 2.3.8, 2.4.0. For users unable to upgrade overwrite the service sulu_route.generator.expression_token_provider and wrap the translator before passing it to the expression language.

Record
CVE-2021-43836
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-vx6j-pjrh-vgjh 8.5

PHP file inclusion in the Sulu admin panel

Impact

What kind of vulnerability is it? Who is impacted?

An attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution.

  • Compromised components: Arbitrary file read on the server, (Potential) Remote code execution
  • Exploitation pre-requisite: User account on the backend

Patches

Has the problem been patched? What versions should users upgrade to?

The problem is patched with the Versions 1.6.44, 2.2.18, 2.3.8, 2.4.0

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Overwrite the service sulu_route.generator.expression_token_provider and wrap the translator before passing it to the expression language.

References

Are there any links users can visit to find out more?

Currently not.

For more information

If you have any questions or comments about this advisory:

Record
GHSA-vx6j-pjrh-vgjh
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
sulu/sulu
Packagist
 before 1.6.44
1.6.44
sulu/sulu
Packagist
 2.0.0 up to 2.2.18
2.2.18
sulu/sulu
Packagist
 2.3.0 up to 2.3.8
2.3.8
sulu/sulu
Packagist
 2.4.0-RC1 to 2.4.0-RC1
2.4.0
sulu/sulu
Packagist
 before 1.6.44, plus listed versions
0.1.00.1.10.10.00.10.10.10.2
Show 45 moreShow less
0.11.00.11.10.11.20.12.00.13.00.13.10.13.20.14.00.14.10.14.20.15.00.15.10.15.20.15.30.16.00.16.10.16.20.17.00.17.0-RC10.17.0-RC20.18.00.18.10.18.20.2.00.3.00.4.00.5.00.6.00.6.10.6.20.6.30.6.40.6.50.6.60.6.70.6.80.7.00.7.10.8.00.8.10.8.20.8.30.8.40.8.50.8.6
1.6.44
sulu/sulu
Packagist
 2.0.0 up to 2.2.18, plus listed versions
2.0.12.0.102.0.112.0.122.0.2
Show 43 moreShow less
2.0.32.0.42.0.52.0.62.0.72.0.82.0.92.1.02.1.0-RC12.1.0-RC22.1.12.1.102.1.112.1.122.1.132.1.142.1.22.1.32.1.42.1.52.1.62.1.72.1.82.1.92.2.02.2.0-RC12.2.12.2.102.2.112.2.122.2.132.2.142.2.152.2.162.2.172.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.9
2.2.18
sulu/sulu
Packagist
 2.3.0 up to 2.3.8, plus listed versions
2.3.12.3.22.3.32.3.42.3.52.3.62.3.7
2.3.8
sulu/sulu
Packagist
 2.4.0-RC1 up to 2.4.0
2.4.0

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-43836 is a high vulnerability (CVSS 8.5) in Sulu, published December 15, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.05%, the 81st percentile. Fixed in sulu/sulu 1.6.44.

References

This page doesn't list everything

Left out here: 153 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open