EXECUTIVE SUMMARY:
Multiple vulnerabilities affecting Silverstripe components have been identified in silverstripe/userforms, silverstripe-advancedworkflow, and silverstripe/versioned. The overall risk/impact is high due to remote code execution through UserForms email subject and AdvancedWorkflow email template fields, which can be abused to run arbitrary code on the server. A cross-site scripting issue in silverstripe/versioned also allows malicious page titles to execute scripts when restoring archived pages.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
Multiple vulnerabilities affecting Silverstripe components have been identified in silverstripe/userforms, silverstripe-advancedworkflow, and silverstripe/versioned. The overall risk/impact is high due to remote code execution through UserForms email subject and AdvancedWorkflow email template fields, which can be abused to run arbitrary code on the server. A cross-site scripting issue in silverstripe/versioned also allows malicious page titles to execute scripts when restoring archived pages.[emaillocker id="1283"]
CVE-2026-54721 (CVSS 8.8 — High): The userform email subject field in the CMS is vulnerable to a specially crafted payload being used to run arbitrary code on the server.
CVE-2026-54718 (CVSS 7.2 — High): The advanced workflow email template field is vulnerable to a specially crafted payload that can be used to run arbitrary code on the server.
CVE-2026-55779 (CVSS 5.4 — Medium): It's possible to use the page title as an XSS vector when restoring a page in ArchiveAdmin.
RECOMMENDATIONS:
REFERENCES:
The following reports contain further technical details:
https://github.com/advisories/GHSA-g8wr-r2v2-vqc6
https://github.com/advisories/GHSA-39mm-rwm3-29jp
https://github.com/advisories/GHSA-m4g4-86qc-v8w7