CVE-2025-25197: Silverstripe Elemental XSS Vulnerability in Content Blocks Report
Summary
CVE-2025-25197: Silverstripe cross-site scripting (XSS) attack in elemental "Content blocks in use" report. Affects dnadesign/silverstripe-elemental versions >= 2.1.2, < 5.3.12. Fixed in 5.3.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Silverstripe is an open-source content management system (CMS) that allows users to create and manage websites with ease. The 'dnadesign/silverstripe-elemental' package is a popular module that provides flexible content blocks for Silverstripe, enabling users to build complex layouts. However, a vulnerability has been identified in this package that affects the 'Content blocks in use' report, allowing for potential cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the failure to properly sanitize user input before displaying it in the 'Content blocks in use' report. An attacker can exploit this flaw by injecting an XSS payload into an elemental block, which can then be executed when the report is viewed by an unsuspecting user. This could lead to unauthorized actions being performed on behalf of the user or sensitive information being disclosed.
How To Fix
Minimum fixed version
5.3.12
This is the first release that contains the fix.
composer require dnadesign/silverstripe-elemental:5.3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the 'Content blocks in use' report until the package is updated. This can be done by modifying user permissions or hiding the report from the user interface.
Conclusion
The identified XSS vulnerability in the Silverstripe Elemental package poses a risk to users viewing the 'Content blocks in use' report. It is crucial to update to the patched version to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for dnadesign/silverstripe-elemental →
FAQ
The vulnerability is a cross-site scripting (XSS) issue that allows attackers to inject malicious scripts into the 'Content blocks in use' report.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without needing to sign up.
If exploited, this vulnerability could lead to unauthorized actions on behalf of users or the exposure of sensitive information.
Yes, a patch is available in version 5.3.12 of the 'dnadesign/silverstripe-elemental' package.
The CVSS score for this vulnerability is 5.4, indicating a moderate severity level.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
