High severity8.5NVD Advisory· Published Dec 15, 2021· Updated Jun 17, 2026
CVE-2021-43836
CVE-2021-43836
Description
Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions an attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution. The problem is patched with the Versions 1.6.44, 2.2.18, 2.3.8, 2.4.0. For users unable to upgrade overwrite the service sulu_route.generator.expression_token_provider and wrap the translator before passing it to the expression language.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
sulu/suluPackagist | < 1.6.44 | 1.6.44 |
sulu/suluPackagist | >= 2.0.0, < 2.2.18 | 2.2.18 |
sulu/suluPackagist | >= 2.3.0, < 2.3.8 | 2.3.8 |
sulu/suluPackagist | >= 2.4.0-RC1, < 2.4.0 | 2.4.0 |
Affected products
4Patches
Vulnerability mechanics
References
4- github.com/sulu/sulu/commit/9c948f9ce350c68b53af8c3910e2cefc7f722b54nvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-vx6j-pjrh-vgjhghsaADVISORY
- github.com/sulu/sulu/security/advisories/GHSA-vx6j-pjrh-vgjhnvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2021-43836ghsaADVISORY
News mentions
0No linked articles in our index yet.