SS-2026-003 RCE via renamed uploaded file
- Severity:
- High (?)
- Identifier:
- SS-2026-003
- Versions Affected:
- silverstripe/assets: < 2.4.6 || >= 3.0.0, < 3.2.4
- Versions Fixed:
- silverstripe/assets: 2.4.6, 3.2.4
- Release Date:
- 2026-10-28
A CMS user who can upload and rename files could bypass file extension validation and store a PHP file in the public assets directory. On a server running Apache, that file could then be executed, running code on the server. After upgrading, flush the site so that the protective .htaccess file in the assets directory is regenerated. Web servers other than Apache need equivalent rules in their own configuration.
Base CVSS: 8.8
Reported by: Jack Wallace
