Is CVE-2026-54717 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54717 being exploited in the wild.

How severe is CVE-2026-54717?

Medium severity, with a CVSS score of 5.4, published 6 August 2026.

Which products and versions are affected?

silverstripe/cms (Packagist) < 6.2.1, ECOSYSTEM:introduced=0,fixed=6.2.1.

Is there a fix for CVE-2026-54717?

Yes. silverstripe/cms (Packagist): upgrade to 6.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54717 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-54717?

Check whether you run silverstripe/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54717: Silverstripe CMS cross-site scripting in breadcrumbs page list view

Q: Is there a fix for CVE-2026-54717?

Yes. silverstripe/cms (Packagist): upgrade to 6.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54717 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-54717?

Check whether you run silverstripe/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54717 · Severity: medium · CVSS 5.4 · Published 2026-08-06

Silverstripe CMS, a platform used for managing website content, is vulnerable to a security flaw where malicious scripts can be injected into the administrative interface. An attacker could potentially use this to perform actions on behalf of a logged-in administrator if they are tricked into viewing a specific page list. This could lead to unauthorized changes to the website or the theft of sensitive session information.

Technologies: silverstripe/cms (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-54717 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54717 being exploited in the wild.
How severe is CVE-2026-54717?: Medium severity, with a CVSS score of 5.4, published 6 August 2026.
Which products and versions are affected?: silverstripe/cms (Packagist) < 6.2.1, ECOSYSTEM:introduced=0,fixed=6.2.1.
Is there a fix for CVE-2026-54717?: Yes. silverstripe/cms (Packagist): upgrade to 6.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54717 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-54717?: Check whether you run silverstripe/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

silverstripe/cms (Packagist): upgrade to 6.2.1 or later
```
composer require silverstripe/cms:^6.2.1
```

Technical details

A cross-site scripting (XSS) vulnerability exists in Silverstripe CMS versions prior to 6.2.1. The vulnerability is located in the breadcrumb navigation component of the CMSMain controller when rendering the page list view. The root cause is the failure to properly escape page titles before they are rendered in the breadcrumbs. An attacker can exploit this by creating a page with a malicious payload in the title; when an administrative user views the page list, the script executes in their browser context. This is a stored XSS attack that requires user interaction (viewing the list) but no specific administrative privileges for the attacker if they have page creation rights. The issue is fixed in version 6.2.1 by ensuring page titles are escaped in the breadcrumb template.

Affected products

Silverstripe cms < 6.2.1

Identifiers

CVE-2026-54717
GHSA-w3cp-g2pf-65wh

Timeline

2026-06-24: patched: Fix merged and version 6.2.1 released
2026-08-06: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.