Is CVE-2026-54720 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54720 being exploited in the wild.

How severe is CVE-2026-54720?

Medium severity, with a CVSS score of 5.4, published 1 July 2026.

Which products and versions are affected?

silverstripe/framework (Packagist) < 6.2.2, ECOSYSTEM:introduced=0,fixed=6.2.2; Silverstripe < 6.2.2.

Is there a fix for CVE-2026-54720?

Yes. silverstripe/framework (Packagist): upgrade to 6.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54720 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54720?

Check whether you run silverstripe/framework (Packagist) or Silverstripe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54720: Silverstripe Framework XSS in Insert media from web functionality

Q: Is there a fix for CVE-2026-54720?

Yes. silverstripe/framework (Packagist): upgrade to 6.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54720 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54720?

Check whether you run silverstripe/framework (Packagist) or Silverstripe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54720 · Severity: medium · CVSS 5.4 · Published 2026-07-01

Silverstripe Framework's CMS includes a "Insert media from web" feature that allows content editors to embed media into pages. A maliciously crafted embed can inject arbitrary JavaScript code that executes in the context of the CMS, potentially allowing an attacker to steal session credentials, modify content, or compromise editor accounts.

Technologies: silverstripe/framework (Packagist). Vendors: Packagist, Silverstripe.

Quick answers

Is CVE-2026-54720 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54720 being exploited in the wild.
How severe is CVE-2026-54720?: Medium severity, with a CVSS score of 5.4, published 1 July 2026.
Which products and versions are affected?: silverstripe/framework (Packagist) < 6.2.2, ECOSYSTEM:introduced=0,fixed=6.2.2; Silverstripe < 6.2.2.
Is there a fix for CVE-2026-54720?: Yes. silverstripe/framework (Packagist): upgrade to 6.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54720 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54720?: Check whether you run silverstripe/framework (Packagist) or Silverstripe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

silverstripe/framework (Packagist): upgrade to 6.2.2 or later
```
composer require silverstripe/framework:^6.2.2
```

Technical details

The vulnerability is a cross-site scripting (XSS) flaw in the embed media handling component of Silverstripe Framework's CMS. The root cause is insufficient sanitization of iframe attributes when processing embeds; specifically, event handler attributes (like "on*" attributes) are not stripped from iframe tags before they are returned to the main document context. The attack vector is network-based and requires user interaction (an editor must embed a specially crafted media URL). An attacker without authentication can craft a malicious embed URL that, when pasted into the CMS media insertion dialog by an authenticated editor, executes arbitrary JavaScript in the editor's browser session. The fix, released in version 6.2.2, removes dangerous attributes from iframe embeds via a new `removeDangerousAttributes()` function.

Affected products

Silverstripe Framework < 6.2.2

Identifiers

CVE-2026-54720
GHSA-gvrw-qqp5-jgc5

Timeline

2026-06-24: disclosed
2026-06-24: patched: Version 6.2.2 released
2026-08-27: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.