sulu/sulu
Core framework that implements the functionality of the Sulu content management system
92%
Total Score
healthy
Healthy: frequent releases and active, distributed maintenance support this release.
Health Score Breakdown
The package declares 91 runtime dependencies, which is a substantial dependency surface for a full CMS framework. Its broad scope makes this expected, but it increases the maintenance burden compared with a small library.
Composer is used as the build tool, but no security-scanning tool was detected. The repository's SECURITY.md provides some compensating security-process transparency, though automated scanning coverage is not shown.
All three workflows were analyzed successfully, with no untrusted checkouts, script injection, or write-all token permissions. The audit found one high-confidence low-severity adhoc-package installation outside a lockfile, which is a limited reproducibility concern.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-115593 sulu/sulu is vulnerable to SQL Injection in versions 1.6.0 - 2.6.24. | 1.6.0 - 2.6.24 | Medium |
AIKIDO-2026-522749 sulu/sulu is vulnerable to Insecure Direct Object Reference (IDOR) in versions 0.0.1 - 2.6.24 and 3.0.0 - 3.0.7. | 0.0.1 - 2.6.243.0.0 - 3.0.7 | Medium |
AIKIDO-2026-253857 sulu/sulu is vulnerable to Missing Authorization in versions 0.0.1 - 2.6.24 and 3.0.0 - 3.0.7. | 0.0.1 - 2.6.243.0.0 - 3.0.7 | Medium |
AIKIDO-2026-702786 sulu/sulu is vulnerable to Cross-Site Scripting (XSS) in versions 0.0.1 - 2.6.24 and 3.0.0 - 3.0.7. | 0.0.1 - 2.6.243.0.0 - 3.0.7 | Medium |
CVE-2026-45701 sulu/sulu is vulnerable to Use of a Broken or Risky Cryptographic Algorithm in versions 3.0.0-alpha1 - 3.0.5 and 0.0.0 - 2.6.22. | 0.0.0 - 2.6.223.0.0-alpha1 - 3.0.5 | Medium |
Package versions
Maintainers
 Sulu Community |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 psr/log Version ^1.0 || ^2.0 || ^3.0 | — | — |
psr/cache Version ^1.0 || ^2.0 || ^3.0 | — | — |
twig/twig Version ^2.13 || ^3.0 | — | — |
cmsig/seal Version ^0.12.16 | — | — |
nyholm/psr7 Version ^1.3 | — | — |
Weekly Downloads
Info
- Last Published
- 12 days ago
- Created
- 12 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.