Executive brief
Silverstripe Framework's CMS includes a "Insert media from web" feature that allows content editors to embed media into pages. A maliciously crafted embed can inject arbitrary JavaScript code that executes in the context of the CMS, potentially allowing an attacker to steal session credentials, modify content, or compromise editor accounts.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the embed media handling component of Silverstripe Framework's CMS. The root cause is insufficient sanitization of iframe attributes when processing embeds; specifically, event handler attributes (like "on*" attributes) are not stripped from iframe tags before they are returned to the main document context. The attack vector is network-based and requires user interaction (an editor must embed a specially crafted media URL). An attacker without authentication can craft a malicious embed URL that, when pasted into the CMS media insertion dialog by an authenticated editor, executes arbitrary JavaScript in the editor's browser session. The fix, released in version 6.2.2, removes dangerous attributes from iframe embeds via a new `removeDangerousAttributes()` function.
Affected products
- Silverstripe Framework < 6.2.2
Timeline
- 2026-06-24: disclosed
- 2026-06-24: patched: Version 6.2.2 released
- 2026-08-27: advisory
References
- https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-gvrw-qqp5-jgc5
- https://github.com/silverstripe/silverstripe-framework/pull/11993
- https://github.com/silverstripe/silverstripe-framework/commit/1bcb02adfc365c6436dc26ab2f6dd32d97f3979b
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2026-54720.yaml
- https://github.com/silverstripe/silverstripe-framework/releases/tag/6.2.2