logo

Database

Server side cross-site scripting In silverstripe/framework

Description

Silverstripe Framework has a XSS vulnerability in HTML editor

Impact

A bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't catch it.

The server-side sanitisation logic has been updated to sanitise against this attack.

Reported by

James Nicoll from Fujitsu Cyber

References

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2025-301482. NVD-2025-301483. OSV-2025-301484. GHSA-rhx4-hvx9-j3875. GCVE-2025-30148

References

1. https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-rhx4-hvx9-j3872. https://github.com/silverstripe/silverstripe-framework/pull/116823. https://github.com/silverstripe/silverstripe-framework/commit/e99cfd62d160d145a76fcf9631e6b11226e423584. https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2025-30148.yaml5. https://www.silverstripe.org/download/security-releases/cve-2025-30148

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.