EUVD-2026-54257
GHSA-w3cp-g2pf-65wh
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Page title injection requires an authenticated CMS editor account (PR:L); a second CMS user must actively view the list (UI:R); no availability impact applies.
Primary rating from Vendor (https://github.com/silverstripe/silverstripe-cms).
CVSS VectorVendor: https://github.com/silverstripe/silverstripe-cms
Lifecycle Timeline
2DescriptionCVE.org
Impact
Page breadcrumbs in the CMS are vulnerable to XSS when viewed using the page list view
Reporter
Fase Rais Baradika
AnalysisAI
Stored cross-site scripting in Silverstripe CMS's admin page list view allows an authenticated CMS editor to execute arbitrary JavaScript in the browser session of any CMS user who views the page list. The flaw exists in composer/silverstripe/cms prior to 6.2.1, where ancestor page titles were concatenated directly into rendered HTML without HTML-entity escaping in the breadcrumb component. No public standalone exploit code and no CISA KEV listing have been identified; however, the patch diff, GHSA advisory, and test-case payloads are all publicly accessible, making reproduction straightforward for any researcher.
Technical ContextAI
The vulnerability is located in the ListViewForm() method of code/Controllers/CMSMain.php within the silverstripe/cms Composer package (CPE: pkg:composer/silverstripe_cms). When rendering the CMS admin page list, the code iterated over a page's ancestor hierarchy via getAncestors() and built a breadcrumb string by concatenating raw MenuTitle or Title values, then injected that string into an HTML fragment via sprintf('<p class="small cms-list__item-breadcrumbs">%s</p>', $breadcrumbs) without any HTML encoding. Because page titles are user-controlled CMS content, an attacker with edit access can embed <script> tags or event-handler attributes in those fields. The fix introduces the private getListViewBreadcrumbs() method, which wraps every ancestor title through Silverstripe's Convert::raw2xml() HTML-encoding utility before building the fragment. Unit tests were added covering script-tag, ampersand, and double-quote injection vectors. CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) is the correct root-cause classification.
RemediationAI
Upgrade composer/silverstripe/cms to version 6.2.1 or later by running composer require silverstripe/cms:^6.2.1 --update-with-dependencies and deploying the updated build. The fix is delivered via patch PR #3175 (https://github.com/silverstripe/silverstripe-cms/pull/3175) and commit 62f9912baa18c80304f3fa8b6eca71bb5dc2d21e. If an immediate upgrade is blocked, restrict CMS editor access to only fully trusted users who cannot create or rename pages with arbitrary titles - this eliminates the injection vector but limits editorial workflow. As an additional compensating control, audit existing page titles and MenuTitle fields in the database for embedded script content or HTML tags before downgrading exposure. There is no known way to disable only the list-view breadcrumb rendering path without code modification, so code-level mitigation without upgrading is not practical.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today