Summary
Silverstripe Framework: Possible XSS attack through media embed
Advisory details
Impact
The "Insert media from web" functionality in the CMS is vulnerable to XSS from a specially crafted embed.
Reported by
Jack Wallace from Bastion Security
References
- https://github.com/advisories/GHSA-gvrw-qqp5-jgc5
- https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-gvrw-qqp5-jgc5
- https://nvd.nist.gov/vuln/detail/CVE-2026-54720
- https://github.com/silverstripe/silverstripe-framework/pull/11993
- https://github.com/silverstripe/silverstripe-framework/commit/1bcb02adfc365c6436dc26ab2f6dd32d97f3979b
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2026-54720.yaml
- https://github.com/silverstripe/silverstripe-framework/releases/tag/6.2.2
- https://www.silverstripe.org/download/security-releases/cve-2026-54720
Related vulnerabilities
All Supply chain →- CRITICALCVE-2026-102989
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
- CRITICALCVE-2026-104252
Vitess vttablet /twopcz reflected XSS
- MEDIUMCVE-2026-104250
unstructured: Stored XSS via unescaped HTML generation
- HIGHCVE-2026-96230
Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability
- HIGHCVE-2026-108260
@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS
- CRITICALCVE-2026-107845
Contao: Cross-site scripting in the comments bundle