Skip to main content

This site requires you to update your browser. Your browsing experience maybe affected by not having the most up to date version.

CVE-2026-91111 Uploaded XML XSS

CVE-2026-91111 Uploaded XML XSS

Severity:
Medium (?)
Identifier:
CVE-2026-91111
Versions Affected:
silverstripe/userforms: < 7.1.4
Versions Fixed:
silverstripe/userforms: 7.1.4
Release Date:
2026-10-28

A file containing script could be uploaded through a user defined form file upload field under an XML-based file extension. The file was served inline, so the script ran in the browser of a CMS user who opened the uploaded file.

Base CVSS: 6.1
Reported by: Jack Wallace from Bastion Security