Unsafe reflection in SilverStripe Framework - CVE-2026-91115
Published: November 6, 2026
Vulnerability identifier: #VU159831
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-91115
CWE-ID: CWE-470
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to execute arbitrary code on the server.
The vulnerability exists due to unvalidated writer input in SilverStripe Framework's i18nTextCollectorTask reaching the injector when a crafted dev task URL is requested. An unauthenticated remote attacker can trigger arbitrary object creation with controlled constructor arguments by tricking an administrator into following a crafted link, or directly without login when the site is in dev mode.
Affected software
SilverStripe Framework
How to mitigate CVE-2026-91115
Install security update from vendor's website.
SilverStripe Framework - update to 6.2.13