Cross-site scripting in SilverStripe Framework - CVE-2026-91114
Published: November 6, 2026
Vulnerability identifier: #VU159837
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-91114
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated user with access to the Security section to execute JavaScript in another user's browser.
The vulnerability exists due to SilverStripe Framework's PermissionCheckboxSetField accepting permission codes it does not offer and rendering stored codes without HTML escaping. An authenticated user with access to the Security section can submit a malicious permission code that executes when another user views the affected field.
Affected software
SilverStripe Framework
How to mitigate CVE-2026-91114
Install security update from vendor's website.
SilverStripe Framework - update to 6.2.13