Junglewise Threat Intelligence

CVE-2026-54721: Silverstripe userforms remote code execution in email subject

CVE-2026-54721 · Severity: high · CVSS 8.8 · Published 2026-08-27

Executive brief

Silverstripe userforms is a widely-used CMS extension that allows administrators to create and manage user forms with email notifications. The email subject field lacks proper input validation, allowing authenticated CMS users to inject and execute arbitrary server-side code. An attacker with limited CMS access can fully compromise the server, steal sensitive data, or disrupt service availability.

Technical details

This vulnerability is a code injection flaw (CWE-94) resulting from improper input validation (CWE-20) in the userform email subject field. The vulnerable component accepts user-supplied input through the CMS interface without proper sanitization before it is used in dynamic code generation or execution. The attack requires network access and low-privilege CMS authentication; no user interaction is required. An authenticated attacker can craft a payload that executes with the privileges of the web application process, achieving complete confidentiality, integrity, and availability compromise. Patches are available in versions 6.4.9, 7.0.7, and 7.1.1, addressing the vulnerability by implementing proper input validation and neutralizing special elements in email subject handling.

Affected products

  • Silverstripe userforms < 6.4.9
  • Silverstripe userforms >= 7.0.0, < 7.0.7
  • Silverstripe userforms >= 7.1.0, < 7.1.1

Timeline

  • 2026-06-24: disclosed: Vulnerability published to GitHub Advisory Database
  • 2026-06-24: patched: Patches released: version 6.4.9, 7.0.7, 7.1.1
  • 2026-08-27: advisory: Advisory updated and reviewed on GitHub

References