Cross-site scripting in SilverStripe Framework - CVE-2026-88987
Published: November 6, 2026
Vulnerability identifier: #VU159834
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-88987
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated CMS author to execute JavaScript in another user's browser when that user views attacker-controlled stored content.
The vulnerability exists due to the SilverStripe Framework HTML sanitiser failing to remove XHTML and XML data URIs from submitted content. An authenticated CMS author can store content containing these data URIs to trigger stored cross-site scripting when another user views it.
Affected software
SilverStripe Framework
How to mitigate CVE-2026-88987
Install security update from vendor's website.
SilverStripe Framework - update to 6.2.13