CVE-2026-91115 RCE via i18nTextCollectorTask writer parameter
- Severity:
- High (?)
- Identifier:
- CVE-2026-91115
- Versions Affected:
- silverstripe/framework: >= 6.0.0, < 6.2.13
- Versions Fixed:
- silverstripe/framework: 6.2.13
- Release Date:
- 2026-10-28
The writer option of the i18nTextCollectorTask dev task was passed to the injector without validation. A crafted dev task URL could create arbitrary objects with attacker-controlled constructor arguments and run code on the server. Because the dev task did not ask for confirmation, an administrator could be tricked into running it by following a link. On a site in dev mode, no login was needed. CMS 5 is not affected.
Base CVSS: 8.8
Reported by: Jack Wallace
