SS-2026-001 Template injection RCE in userforms
- Severity:
- High (?)
- Identifier:
- SS-2026-001
- Versions Affected:
- silverstripe/userforms: < 6.4.10 || >= 7.0.0, < 7.1.4
- Versions Fixed:
- silverstripe/userforms: 6.4.10, 7.1.4
- Release Date:
- 2026-10-28
The email subject and body of a user defined form email recipient were rendered as templates when the form was submitted. A CMS author who can edit user defined forms could use template code in these fields to perform privileged actions, such as changing another user's password, or to run code on the server.
Base CVSS: 8.8
Reported by: Lachlan Davidson, Carapace
