EUVD-2026-41144
GHSA-gvrw-qqp5-jgc5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts malicious embed payload
-
DeliverySocial engineer CMS editor to insert URL
-
ExploitEditor uses 'Insert media from web' feature
-
ExecutionUnsanitized embed rendered in browser
-
ImpactJavaScript executes in victim's session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a CMS editor actively uses the 'Insert media from web' functionality to insert a URL pointing to attacker-controlled content. The CVSS UI:R metric confirms that user interaction by an authenticated CMS editor is a hard prerequisite - the attacker cannot trigger the vulnerability independently without inducing this action. Exploitation is limited to Silverstripe CMS deployments running Framework versions prior to 6.2.2. There is no indication that the vulnerable feature is exposed to unauthenticated users; a logged-in CMS editor must be the actor who inserts the crafted embed. The scope is unchanged (S:U), so impact is constrained to the CMS session context and page rendering context, not the underlying server. |
| Impact | The CVSS 3.1 score of 5.4 (Medium) reflects a network-exploitable, low-complexity attack requiring no privileges but necessitating user interaction (UI:R), with limited confidentiality and integrity impact and no availability impact. The scope is unchanged (S:U), meaning exploitation is bounded to the context of the affected CMS session. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no proof-of-concept exploit has been identified, both of which reduce urgency relative to the raw CVSS. The primary risk vector is a social-engineering or supply-chain scenario where a CMS editor is induced to embed attacker-controlled media. Because exploitation depends on a CMS user performing an action, automated scanning and mass exploitation are less likely. The practical risk is elevated in organizations whose CMS editors routinely embed third-party media. |
| Exploit ScenarioDerived | An attacker hosts a web resource whose embed response contains a malicious JavaScript payload. The attacker then socially engineers a Silverstripe CMS editor into using the 'Insert media from web' feature to embed that URL into a page or article. When the embed is rendered - either in the editor's own browser or in the browsers of site visitors who view the published content - the unsanitized script executes, potentially stealing session cookies or performing actions on behalf of the victim. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 01, 2026
Cross-site scripting in Silverstripe Framework's 'Insert media from web' CMS feature allows a remote unauthenticated attacker to inject malicious JavaScript by supplying a specially crafted embed URL that a CMS editor then inserts into content. All Silverstripe Framework installations prior to version 6.2.2 are affected. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and network accessibility make it a credible risk for any deployment where CMS editors process externally sourced media.
RemediationAI
Upgrade Silverstripe Framework to version 6.2.2, which contains the vendor-released patch for this issue. Details are available in the official security release at https://www.silverstripe.org/download/security-releases/cve-2026-54720 and the GitHub advisory at https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-gvrw-qqp5-jgc5. If an immediate upgrade is not possible, restrict CMS editor access so that only fully trusted users can use the 'Insert media from web' feature, reducing the attack surface by limiting who can insert externally sourced embeds. Disabling the embed/media-from-web feature entirely via CMS configuration is an effective compensating control with the trade-off of losing that editorial capability. Content Security Policy (CSP) headers can also limit the impact of any injected scripts by restricting script sources, though this does not eliminate the vulnerability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Silverstripe Framework is a PHP-based web application framework that powers the Silverstripe CMS. The affected component is the 'Insert media from web' embed functionality, which allows authenticated CMS editors to embed externally hosted media by providing a URL. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: the framework fails to properly sanitize or encode the embed content returned from an external source before rendering it in the browser, allowing injected HTML or JavaScript to execute. The affected CPE is cpe:2.3:a:silverstripe:silverstripe-framework:*:*:*:*:*:*:*:*, covering all versions of the framework prior to 6.2.2 in the 6.x line.
Know when Silverstripe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
AV:N and PR:N because attacker only needs to host a malicious URL; UI:R reflects mandatory CMS editor interaction; no availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. In versions prior to 6.2.2, the "Insert media from web" functionality in the CMS is vulnerable to XSS from a specially crafted embed. This issue was fixed in version 6.2.2/
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Silverstripe
View allsecurity/MemberLoginForm.php in SilverStripe 3.0.3 supports login using a GET request, which makes it easier for remote
SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the conte
Open redirect vulnerability in SilverStripe CMS & Framework 3.1.13 allows remote attackers to redirect users to arbitrar
In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticat
SQL injection vulnerability in silverstripe/restfulserver module 1.0.x before 1.0.9, 2.0.x before 2.0.4, and 2.1.x befor
All versions of SilverStripe 3 prior to 3.6.7 and 3.7.3, and all versions of SilverStripe 4 prior to 4.0.7, 4.1.5, 4.2.4
Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin thr
security/MemberLoginForm.php in SilverStripe 3.0.3 supports credentials in a GET request, which allows remote or local a
Silverstripe silverstripe/framework through 4.11 allows SQL Injection. Rated high severity (CVSS 8.8), this vulnerabilit
Silverstripe CMS through 4.5 can be susceptible to script execution from malicious upload contents under allowed file ex
Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow rem
Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework 3.1.13 allow remote attackers to inj
Exploit-DB