CVE-2026-88991 RCE in email subject field via template execution
- Severity:
- High (?)
- Identifier:
- CVE-2026-88991
- Versions Affected:
- silverstripe/userforms: < 6.4.10 || >= 7.0.0, < 7.1.4
- Versions Fixed:
- silverstripe/userforms: 6.4.10, 7.1.4
- Release Date:
- 2026-10-28
The email subject of a user defined form email recipient was rendered as a template when the form was submitted. A CMS author who can edit user defined forms could use template code in this field to run code on the server.
Base CVSS: 8.8
Reported by: Jack Wallace from Bastion Security
