SS-2026-006 RCE via template string escaping in userforms email subject
- Severity:
- High (?)
- Identifier:
- SS-2026-006
- Versions Affected:
- silverstripe/userforms: < 6.4.10 || >= 7.0.0, < 7.1.4
- Versions Fixed:
- silverstripe/userforms: 6.4.10, 7.1.4
- Release Date:
- 2026-10-28
The email subject of a user defined form email recipient was rendered as a template when the form was submitted. A CMS author who can edit user defined forms could use crafted template code in this field to run code on the server.
Base CVSS: 8.8
Reported by: Fred D. (Bastion Security Group)
