CVE-2026-54720: Silverstripe Framework XSS Vulnerability in Media Embed Functionality
Summary
CVE-2026-54720: Silverstripe Framework: Possible XSS attack through media embed. Affects silverstripe/framework versions < 6.2.2. Fixed in 6.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Silverstripe Framework is an open-source content management system (CMS) designed for building and managing websites. It provides a flexible and user-friendly interface for developers and content editors to create and manage digital content. The framework includes various features such as templating, database management, and media handling. However, a vulnerability has been identified in the 'Insert media from web' functionality, which allows for potential cross-site scripting (XSS) attacks through maliciously crafted media embeds.
Vulnerability Detail
The vulnerability arises from the 'Insert media from web' feature in the Silverstripe CMS, which does not adequately sanitize user input. This oversight allows an attacker to inject malicious scripts into the media embed code. When a user views the affected page, the script can execute in their browser, potentially leading to data theft, session hijacking, or other malicious activities. The vulnerability is classified under CWE-79, indicating its nature as an XSS issue.
How To Fix
Minimum fixed version
6.2.2
This is the first release that contains the fix.
composer require silverstripe/framework:6.2.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the 'Insert media from web' functionality until the framework is updated. Additionally, implement input validation and sanitization on any user-generated content to mitigate the risk of XSS attacks.
Conclusion
The CVE-2026-54720 vulnerability in the Silverstripe Framework poses a significant risk due to its potential for XSS attacks through the media embed feature. Users are advised to update to version 6.2.2 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for silverstripe/framework →
FAQ
CVE-2026-54720 is a vulnerability in the Silverstripe Framework that allows for potential XSS attacks through the media embed functionality.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor vulnerabilities without requiring sign-up.
If exploited, this vulnerability can lead to data theft, session hijacking, and other malicious activities that compromise user security.
Yes, the vulnerability has been patched in version 6.2.2 of the Silverstripe Framework. It is recommended to update to this version or later.
The CVSS score of this vulnerability is 5.4, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for silverstripe/framework.
