Skip to main content

This site requires you to update your browser. Your browsing experience maybe affected by not having the most up to date version.

CVE-2026-88992 Userforms CSV export restricted file access

CVE-2026-88992 Userforms CSV export restricted file access

Severity:
Medium (?)
Identifier:
CVE-2026-88992
Versions Affected:
silverstripe/userforms: < 7.1.4
Versions Fixed:
silverstripe/userforms: 7.1.4
Release Date:
2026-10-28

Exporting user defined form submissions to CSV gave the exporting user access to uploaded files that they did not have permission to view.

Base CVSS: 4.3
Reported by: Will Frame (wpf.nz)