medium5.4
CVE-2026-54720
Silverstripe Framework is a PHP framework which powers the Silverstripe CMS.
Impact
Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. In versions prior to 6.2.2, the "Insert media from web" functionality in the CMS is vulnerable to XSS from a specially crafted embed. This issue was fixed in version 6.2.2/
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | silverstripe/framework | < 6.2.2 | 6.2.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-gvrw-qqp5-jgc5
- https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-gvrw-qqp5-jgc5
- https://nvd.nist.gov/vuln/detail/CVE-2026-54720
- https://github.com/silverstripe/silverstripe-framework/pull/11993
- https://github.com/silverstripe/silverstripe-framework/commit/1bcb02adfc365c6436dc26ab2f6dd32d97f3979b
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2026-54720.yaml
- https://github.com/silverstripe/silverstripe-framework/releases/tag/6.2.2
- https://www.silverstripe.org/download/security-releases/cve-2026-54720