CVE-2025-30148: Silverstripe Framework XSS Vulnerability in HTML Editor
Summary
CVE-2025-30148: Silverstripe Framework has a XSS vulnerability in HTML editor. Affects silverstripe/framework versions < 5.3.23. Fixed in 5.3.23. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Silverstripe Framework is an open-source content management system (CMS) that allows users to create and manage websites. It is known for its flexibility and ease of use, providing a robust platform for developers and content creators. However, like many web applications, it is susceptible to security vulnerabilities, including cross-site scripting (XSS) attacks, which can compromise the integrity of the site and the safety of its users.
Vulnerability Detail
The vulnerability arises from inadequate server-side sanitization of user inputs in the HTML editor of the Silverstripe Framework. A malicious actor with editing access can craft a specially encoded payload that, when sent to the server, can inject JavaScript into the front end of the site. Although client-side sanitization attempts to mitigate this risk, it fails to catch the payload on the server side, allowing for potential exploitation. This could lead to unauthorized actions being performed on behalf of users or the exposure of sensitive information.
How To Fix
Minimum fixed version
5.3.23
This is the first release that contains the fix.
composer require silverstripe/framework:5.3.23Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the HTML editor for untrusted users until the framework is updated. This can be done by modifying user permissions in the CMS settings.
Conclusion
The Silverstripe Framework XSS vulnerability (CVE-2025-30148) poses a significant risk to users with editing access. It is crucial to update to the patched version (5.3.23) to safeguard against potential attacks. Implementing the recommended fixes and workarounds will help maintain the security of your application.
See every vulnerability recorded for silverstripe/framework →
FAQ
The vulnerability is a cross-site scripting (XSS) issue that allows attackers to inject malicious JavaScript into the site.
The vulnerability was reported by James Nicoll from Fujitsu Cyber.
If exploited, this vulnerability could allow attackers to execute unauthorized actions on behalf of users or steal sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
