Skip to main content

This site requires you to update your browser. Your browsing experience maybe affected by not having the most up to date version.

CVE-2026-88987 XSS via XHTML data URI

CVE-2026-88987 XSS via XHTML data URI

Severity:
Medium (?)
Identifier:
CVE-2026-88987
Versions Affected:
silverstripe/framework: < 6.2.13
Versions Fixed:
silverstripe/framework: 6.2.13
Release Date:
2026-10-28

The HTML sanitiser did not remove XHTML and XML data URIs. A CMS author could store content that runs JavaScript in the browser of another user who views it.

Base CVSS: 5.4
Reported by: Jack Wallace from Bastion Security