Executive brief
Silverstripe CMS, a platform used for managing website content, is vulnerable to a security flaw where malicious scripts can be injected into the administrative interface. An attacker could potentially use this to perform actions on behalf of a logged-in administrator if they are tricked into viewing a specific page list. This could lead to unauthorized changes to the website or the theft of sensitive session information.
Technical details
A cross-site scripting (XSS) vulnerability exists in Silverstripe CMS versions prior to 6.2.1. The vulnerability is located in the breadcrumb navigation component of the CMSMain controller when rendering the page list view. The root cause is the failure to properly escape page titles before they are rendered in the breadcrumbs. An attacker can exploit this by creating a page with a malicious payload in the title; when an administrative user views the page list, the script executes in their browser context. This is a stored XSS attack that requires user interaction (viewing the list) but no specific administrative privileges for the attacker if they have page creation rights. The issue is fixed in version 6.2.1 by ensuring page titles are escaped in the breadcrumb template.
Affected products
- Silverstripe cms < 6.2.1
Timeline
- 2026-06-24: patched: Fix merged and version 6.2.1 released
- 2026-08-06: advisory: GitHub Advisory published
References
- https://github.com/silverstripe/silverstripe-cms/security/advisories/GHSA-w3cp-g2pf-65wh
- https://github.com/silverstripe/silverstripe-cms/pull/3175
- https://github.com/silverstripe/silverstripe-cms/commit/62f9912baa18c80304f3fa8b6eca71bb5dc2d21e
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/cms/CVE-2026-54717.yaml
- https://github.com/silverstripe/silverstripe-cms/releases/tag/6.2.1
- https://www.silverstripe.org/download/security-releases/cve-2026-54717