Security Releases

When potential security holes are discovered in SilverStripe's supported modules, we produce security releases to ensure that you are able to promptly secure your SilverStripe websites (check our security release process). All releases are available on our download page, and are announced on our forums (register to subscribe). Vulnerabilities in releases are disclosed here. Please subscribe to our security release RSS feed and pre-announcement mailing list to stay updated.

• SS-2026-007 RCE via template string escaping in advanced workflow email template

  Severity:

  High (?)

  Identifier:

  SS-2026-007

  Versions Affected:

  symbiote/silverstripe-advancedworkflow: < 6.4.6 || >= 7.0.0, < 7.2.4

  Versions Fixed:

  symbiote/silverstripe-advancedworkflow: 6.4.6, 7.2.4

  Release Date:

  2026-10-28

  The email template of an advanced workflow "Notify Users" action was rendered as a template when the action ran. A CMS user who can edit workflow definitions could use crafted template code in this field to run code on the server.

  This vulnerability has no commit of its own to resolve it. Instead, the fix for SS-2026-002 also fixes it.

  Base CVSS: 7.2
  Reported by: Steve Boyd, Silverstripe Ltd.

• SS-2026-006 RCE via template string escaping in userforms email subject

  Severity:

  High (?)

  Identifier:

  SS-2026-006

  Versions Affected:

  silverstripe/userforms: < 6.4.10 || >= 7.0.0, < 7.1.4

  Versions Fixed:

  silverstripe/userforms: 6.4.10, 7.1.4

  Release Date:

  2026-10-28

  The email subject of a user defined form email recipient was rendered as a template when the form was submitted. A CMS author who can edit user defined forms could use crafted template code in this field to run code on the server.

  This vulnerability has no commit of its own to resolve it. Instead, the fix for SS-2026-001 also fixes it.

  Base CVSS: 8.8
  Reported by: Fred D. (Bastion Security Group)

• SS-2026-005 XSS in required field label

  Severity:

  Medium (?)

  Identifier:

  SS-2026-005

  Versions Affected:

  silverstripe/userforms: < 7.1.4

  Versions Fixed:

  silverstripe/userforms: 7.1.4

  Release Date:

  2026-10-28

  When a required field identifier is configured, the title of a user defined form field was rendered without escaping on the public form. A CMS author could use this to store content that runs JavaScript in the browser of a visitor.

  Base CVSS: 4.4
  Reported by: HDWSec - https://hdwsec.fr

• SS-2026-004 Password reset token account takeover

  Severity:

  Medium (?)

  Identifier:

  SS-2026-004

  Versions Affected:

  silverstripe/framework: < 6.2.13

  Versions Fixed:

  silverstripe/framework: 6.2.13

  Release Date:

  2026-10-28

  For members with no password encryption settings stored, a password reset token issued to one member could be accepted for another member. This could be used to reset the other member's password and log in as them.

  Base CVSS: 6.8
  Reported by: Mufeed VH from Winfunc

• SS-2026-003 RCE via renamed uploaded file

  Severity:

  High (?)

  Identifier:

  SS-2026-003

  Versions Affected:

  silverstripe/assets: < 2.4.6 || >= 3.0.0, < 3.2.4

  Versions Fixed:

  silverstripe/assets: 2.4.6, 3.2.4

  Release Date:

  2026-10-28

  A CMS user who can upload and rename files could bypass file extension validation and store a PHP file in the public assets directory. On a server running Apache, that file could then be executed, running code on the server. After upgrading, flush the site so that the protective .htaccess file in the assets directory is regenerated. Web servers other than Apache need equivalent rules in their own configuration.

  Base CVSS: 8.8
  Reported by: Jack Wallace

• SS-2026-002 Template injection RCE in advanced workflow

  Severity:

  High (?)

  Identifier:

  SS-2026-002

  Versions Affected:

  symbiote/silverstripe-advancedworkflow: < 6.4.6 || >= 7.0.0, < 7.2.4

  Versions Fixed:

  symbiote/silverstripe-advancedworkflow: 6.4.6, 7.2.4

  Release Date:

  2026-10-28

  The email template of an advanced workflow "Notify Users" action was rendered as a template when the action ran. A CMS user who can edit workflow definitions could use template code in this field to perform privileged actions or to run code on the server.

  Base CVSS: 7.2
  Reported by: Lachlan Davidson, Carapace

• SS-2026-001 Template injection RCE in userforms

  Severity:

  High (?)

  Identifier:

  SS-2026-001

  Versions Affected:

  silverstripe/userforms: < 6.4.10 || >= 7.0.0, < 7.1.4

  Versions Fixed:

  silverstripe/userforms: 6.4.10, 7.1.4

  Release Date:

  2026-10-28

  The email subject and body of a user defined form email recipient were rendered as templates when the form was submitted. A CMS author who can edit user defined forms could use template code in these fields to perform privileged actions, such as changing another user's password, or to run code on the server.

  Base CVSS: 8.8
  Reported by: Lachlan Davidson, Carapace

• CVE-2026-91115 RCE via i18nTextCollectorTask writer parameter

  Severity:

  High (?)

  Identifier:

  CVE-2026-91115

  Versions Affected:

  silverstripe/framework: >= 6.0.0, < 6.2.13

  Versions Fixed:

  silverstripe/framework: 6.2.13

  Release Date:

  2026-10-28

  The writer option of the i18nTextCollectorTask dev task was passed to the injector without validation. A crafted dev task URL could create arbitrary objects with attacker-controlled constructor arguments and run code on the server. Because the dev task did not ask for confirmation, an administrator could be tricked into running it by following a link. On a site in dev mode, no login was needed. CMS 5 is not affected.

  Base CVSS: 8.8
  Reported by: Jack Wallace

• CVE-2026-91114 Stored XSS via unescaped permission in PermissionCheckboxSetField

  Severity:

  Medium (?)

  Identifier:

  CVE-2026-91114

  Versions Affected:

  silverstripe/framework: < 6.2.13

  Versions Fixed:

  silverstripe/framework: 6.2.13

  Release Date:

  2026-10-28

  PermissionCheckboxSetField saved permission codes that the field did not offer, and rendered permission codes without escaping them. A user with access to the Security section could use this to store content that runs JavaScript in the browser of another user.

  Base CVSS: 4.4
  Reported by: Lachlan Davidson, Carapace

• CVE-2026-91113 User-controlled ClassName allows unauthorized record type change

  Severity:

  Medium (?)

  Identifier:

  CVE-2026-91113

  Versions Affected:

  silverstripe/framework: < 6.2.13

  Versions Fixed:

  silverstripe/framework: 6.2.13

  Release Date:

  2026-10-28

  A user who can edit a record through a GridField detail form could change the record to an unrelated class, without the permission checks for that class.

  Base CVSS: 4.3
  Reported by: Lachlan Davidson, Carapace

• CVE-2026-91112 CMS_ACCESS_SecurityAdmin privilege escalation

  Severity:

  Medium (?)

  Identifier:

  CVE-2026-91112

  Versions Affected:

  silverstripe/framework: < 6.2.13

  Versions Fixed:

  silverstripe/framework: 6.2.13

  Release Date:

  2026-10-28

  A user with access to the Security section (CMS_ACCESS_SecurityAdmin) but without the ADMIN permission could edit a group that grants ADMIN through a role or a parent group, and use it to escalate their own privileges.

  Base CVSS: 6.8
  Reported by: Lachlan Davidson, Carapace

• CVE-2026-91111 Uploaded XML XSS

  Severity:

  Medium (?)

  Identifier:

  CVE-2026-91111

  Versions Affected:

  silverstripe/userforms: < 7.1.4

  Versions Fixed:

  silverstripe/userforms: 7.1.4

  Release Date:

  2026-10-28

  A file containing script could be uploaded through a user defined form file upload field under an XML-based file extension. The file was served inline, so the script ran in the browser of a CMS user who opened the uploaded file.

  Base CVSS: 6.1
  Reported by: Jack Wallace from Bastion Security

• CVE-2026-91110 XSS using control bytes

  Severity:

  Medium (?)

  Identifier:

  CVE-2026-91110

  Versions Affected:

  silverstripe/framework: < 6.2.13

  Versions Fixed:

  silverstripe/framework: 6.2.13

  Release Date:

  2026-10-28

  The HTML sanitiser did not remove javascript: URLs preceded by certain control bytes. A CMS author could store content that runs JavaScript in the browser of another user who views it.

  Base CVSS: 6.4
  Reported by: Jack Wallace from Bastion Security

• CVE-2026-88992 Userforms CSV export restricted file access

  Severity:

  Medium (?)

  Identifier:

  CVE-2026-88992

  Versions Affected:

  silverstripe/userforms: < 7.1.4

  Versions Fixed:

  silverstripe/userforms: 7.1.4

  Release Date:

  2026-10-28

  Exporting user defined form submissions to CSV gave the exporting user access to uploaded files that they did not have permission to view.

  Base CVSS: 4.3
  Reported by: Will Frame (wpf.nz)

• CVE-2026-88991 RCE in email subject field via template execution

  Severity:

  High (?)

  Identifier:

  CVE-2026-88991

  Versions Affected:

  silverstripe/userforms: < 6.4.10 || >= 7.0.0, < 7.1.4

  Versions Fixed:

  silverstripe/userforms: 6.4.10, 7.1.4

  Release Date:

  2026-10-28

  The email subject of a user defined form email recipient was rendered as a template when the form was submitted. A CMS author who can edit user defined forms could use template code in this field to run code on the server.
  
  This vulnerability has no commit of its own to resolve it. Instead, the fix for SS-2026-001 also fixes it.

  Base CVSS: 8.8
  Reported by: Jack Wallace from Bastion Security

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• Next