EUVD-2026-67239
GHSA-g8wr-r2v2-vqc6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain CMS author credentials
-
DeliveryAuthenticate to Silverstripe CMS
-
ExploitEdit email recipient EmailSubject field with PHP template payload
-
InstallSubmit userform to trigger email dispatch
-
C2Template engine evaluates injected PHP server-side
-
ExecuteArbitrary code executes as web server user
-
ImpactFull server compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires an authenticated Silverstripe CMS session with at minimum author-level permissions sufficient to edit email recipient records on a userform - specifically the ability to write to the EmailSubject field of an EmailRecipient object. This maps to PR:L in the CVSS vector. The vulnerability fires during email dispatch triggered by form submission; the attacker can self-submit the form to trigger execution without needing a third-party victim, supporting UI:N. Exploitation is limited by: (1) the attacker must hold CMS credentials (not a network-accessible unauthenticated path); (2) the target site must have the silverstripe/userforms module installed with at least one form configured with an email recipient; (3) the web server process must have write access to paths of interest for maximum impact, though RCE itself does not require this. Sites with a single administrator account and no delegated CMS authoring significantly reduce the attacker population. |
| Impact | CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects high post-exploitation impact - full confidentiality, integrity, and availability compromise - with the critical limiting factor being PR:L, meaning only authenticated CMS-level users can exploit this. Organizations that issue CMS author accounts broadly (e.g., content editors, marketing teams) face meaningfully elevated risk since any such user could weaponize this without elevated privileges. No EPSS data was provided in the input, and absence of a CISA KEV listing indicates no confirmed mass exploitation as of analysis. However, the test case added in PR #1441 documents the exact working payload, which functions as implicit proof-of-concept documentation. Real-world priority should be HIGH for Silverstripe deployments with multiple CMS users; MODERATE for single-administrator deployments where CMS access is tightly controlled. |
| Exploit ScenarioDerived | An authenticated CMS author navigates to a userform's email recipient configuration and sets the EmailSubject to a template injection payload such as |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 27, 2026
Remote code execution in the Silverstripe userforms module allows any authenticated CMS author to inject PHP into the email recipient's subject field, which is evaluated server-side by the Silverstripe template engine during form submission email dispatch. Affected are composer package silverstripe/userforms versions below 6.4.9, 7.0.0-7.0.6, and 7.1.0, all of which pass the EmailSubject field through the template parser without sanitizing PHP-bearing localization tags. No CISA KEV listing and no standalone public exploit exist at time of analysis, though the patch PR documents the exact payload format, materially lowering the exploitation barrier for any attacker holding CMS credentials.
RemediationAI
Update silverstripe/userforms via Composer to version 6.4.9 (for the 6.x branch), 7.0.7 (for the 7.0.x branch), or 7.1.1 (for the 7.1.x branch) using composer require silverstripe/userforms:^6.4.9 or the appropriate constraint; this also pulls in the required silverstripe/template-engine ^1.0.1 fix. Patches are at https://github.com/silverstripe/silverstripe-userforms/pull/1441 and https://github.com/silverstripe/silverstripe-userforms/pull/1442, with commits 23c069866900c19b499bfa997d1e251e97491702 and c55494ad7c717b199a3c1663b43a54db5d95604c. If immediate patching is not feasible, restrict CMS access permissions so only fully trusted administrators can configure email recipient settings - this eliminates the attack surface since the vulnerability is only exploitable by users who can write the EmailSubject field. There is no configuration-level toggle to disable template rendering of the subject field in unpatched versions. Vendor advisory: https://www.silverstripe.org/download/security-releases/cve-2026-54721.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Silverstripe's template engine processes content containing <%t %> localization tags at render time, including evaluation of PHP expressions embedded in default-value strings via variable interpolation. The EmailSubject field on EmailRecipient records is stored as author-controlled text and rendered as a template during email dispatch, meaning injected content such as <%t Foo "{${'file_put_contents'(...)}}" %> causes arbitrary PHP functions to execute in the server process. The fix in PR #1441 introduces a dependency on silverstripe/template-engine ^1.0.1, patching the template engine to neutralize user-supplied content before evaluation. CWE-20 (Improper Input Validation) is the NVD assignment, though CWE-94 (Code Injection) or CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine) more precisely characterizes the root cause - unsanitized author input being passed to a template interpreter with PHP execution capability.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
PR:L reflects mandatory CMS authentication; UI:N because attacker can self-submit the form; full C/I/A from arbitrary PHP execution in the server process.
Primary rating from Vendor (https://github.com/silverstripe/silverstripe-userforms).
CVSS VectorVendor: https://github.com/silverstripe/silverstripe-userforms
DescriptionCVE.org
Impact
The userform email subject field in the CMS is vulnerable to a specially crafted payload being used to run arbitrary code on the server.
Reported by
Jack Wallace from Bastion Security
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Silverstripe userforms module (affected versions below 6.4.9, 7.0.0-7.0.6, and 7.1.0) is vulnerable to remote code execution when CMS authors inject code through email subject fields of form submissions. Organizations using affected versions must urgently patch or restrict CMS author capabilities to prevent unauthorized code execution and potential system compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB