Cross-site scripting in SilverStripe Framework - CVE-2026-91110
Published: November 6, 2026
Vulnerability identifier: #VU159838
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-91110
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated remote CMS author to execute JavaScript in the browser of another user who views stored content.
The vulnerability exists due to the SilverStripe Framework HTML sanitiser failing to remove javascript: URLs when they are preceded by certain control bytes. An authenticated remote CMS author can store content containing these crafted URLs, causing stored cross-site scripting when another user views the content.
Affected software
SilverStripe Framework
How to mitigate CVE-2026-91110
Install security update from vendor's website.
SilverStripe Framework - update to 6.2.13