SB20261106104 - Multiple vulnerabilities in SilverStripe Framework

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261106104

SB20261106104 - Multiple vulnerabilities in SilverStripe Framework

Published: November 6, 2026

Security Bulletin ID SB20261106104
CSH Severity
High
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 13% Low 88%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) Unsafe reflection (CVE-ID: CVE-2026-91115)

CWE-ID: CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to execute arbitrary code on the server.

The vulnerability exists due to unvalidated writer input in SilverStripe Framework's i18nTextCollectorTask reaching the injector when a crafted dev task URL is requested. An unauthenticated remote attacker can trigger arbitrary object creation with controlled constructor arguments by tricking an administrator into following a crafted link, or directly without login when the site is in dev mode.


2) Cross-site scripting (CVE-ID: CVE-2026-88988)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an authenticated CMS author to execute JavaScript in the browser of another user who views attacker-controlled stored content.

The vulnerability exists due to the SilverStripe Framework HTML sanitiser failing to remove SVG data URIs from submitted content. An authenticated CMS author can embed a malicious SVG data URI in stored content and trigger script execution when another user views it.


3) Missing Authorization (CVE-ID: CVE-2026-88989)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated CMS user to create records in SilverStripe Framework without the required permission to create them.

The vulnerability exists due to missing creation permission checks in the GridField detail form when processing a directly submitted save request. An authenticated CMS user can exploit existing permission to edit records through that form to submit a save request and create unauthorized records.


4) Cross-site scripting (CVE-ID: CVE-2026-88987)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an authenticated CMS author to execute JavaScript in another user's browser when that user views attacker-controlled stored content.

The vulnerability exists due to the SilverStripe Framework HTML sanitiser failing to remove XHTML and XML data URIs from submitted content. An authenticated CMS author can store content containing these data URIs to trigger stored cross-site scripting when another user views it.


5) Incorrect authorization (CVE-ID: CVE-2026-91112)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged attacker to escalate their own privileges to administrator in SilverStripe Framework.

The vulnerability exists due to insufficient authorization checks in the Security section when editing groups that grant ADMIN through a role or parent group. A low-privileged attacker can use CMS_ACCESS_SecurityAdmin access, without already having ADMIN permission, to edit such a group and obtain administrator privileges.


6) Missing Authorization (CVE-ID: CVE-2026-91113)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker with permission to edit a record to change its type without authorization for the target class.

The vulnerability exists due to missing target-class permission checks when a user-controlled ClassName value is submitted through a GridField detail form in SilverStripe Framework. An authenticated attacker can submit an unrelated class name while editing an accessible record and cause an unauthorized record-type change.


7) Cross-site scripting (CVE-ID: CVE-2026-91114)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an authenticated user with access to the Security section to execute JavaScript in another user's browser.

The vulnerability exists due to SilverStripe Framework's PermissionCheckboxSetField accepting permission codes it does not offer and rendering stored codes without HTML escaping. An authenticated user with access to the Security section can submit a malicious permission code that executes when another user views the affected field.


8) Cross-site scripting (CVE-ID: CVE-2026-91110)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an authenticated remote CMS author to execute JavaScript in the browser of another user who views stored content.

The vulnerability exists due to the SilverStripe Framework HTML sanitiser failing to remove javascript: URLs when they are preceded by certain control bytes. An authenticated remote CMS author can store content containing these crafted URLs, causing stored cross-site scripting when another user views the content.


Remediation

Install update from vendor's website.

References