EUVD-2026-67239
GHSA-g8wr-r2v2-vqc6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
PR:L reflects mandatory CMS authentication; UI:N because attacker can self-submit the form; full C/I/A from arbitrary PHP execution in the server process.
Primary rating from Vendor (https://github.com/silverstripe/silverstripe-userforms).
CVSS VectorVendor: https://github.com/silverstripe/silverstripe-userforms
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Impact
The userform email subject field in the CMS is vulnerable to a specially crafted payload being used to run arbitrary code on the server.
Reported by
Jack Wallace from Bastion Security
AnalysisAI
Remote code execution in the Silverstripe userforms module allows any authenticated CMS author to inject PHP into the email recipient's subject field, which is evaluated server-side by the Silverstripe template engine during form submission email dispatch. Affected are composer package silverstripe/userforms versions below 6.4.9, 7.0.0-7.0.6, and 7.1.0, all of which pass the EmailSubject field through the template parser without sanitizing PHP-bearing localization tags. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Silverstripe CMS session with at minimum author-level permissions sufficient to edit email recipient records on a userform - specifically the ability to write to the EmailSubject field of an EmailRecipient object. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects high post-exploitation impact - full confidentiality, integrity, and availability compromise - with the critical limiting factor being PR:L, meaning only authenticated CMS-level users can exploit this. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update silverstripe/userforms via Composer to version 6.4.9 (for the 6.x branch), 7.0.7 (for the 7.0.x branch), or 7.1.1 (for the 7.1.x branch) using `composer require silverstripe/userforms:^6.4.9` or the appropriate constraint; this also pulls in the required silverstripe/template-engine ^1.0.1 fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Silverstripe installations and identify those running vulnerable silverstripe/userforms versions (below 6.4.9, 7.0.0-7.0.6, or 7.1.0). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today