CVE-2026-54717

Received Received - Intake

Cross-Site Scripting in Silverstripe CMS

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list view, because page titles are rendered into the breadcrumb trail without being escaped. This issue is fixed in 6.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-54717

Affected Vendors & Products

Vendor	Product	Version / Range
silverstripe	silverstripe_cms	6.2.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Silverstripe CMS versions before 6.2.1 have a cross-site scripting vulnerability in page breadcrumbs when viewed in the page list view. Page titles are rendered into the breadcrumb trail without proper escaping, allowing malicious scripts to be injected.

Detection Guidance

To detect this vulnerability, check the Silverstripe CMS version installed on your system. Run commands like 'composer show silverstripe/cms' or check the version in the CMS admin panel. If the version is below 6.2.1, the system is vulnerable.

Impact Analysis

An attacker could exploit this to execute malicious scripts in a user's browser when they view the page list in the CMS. This could lead to theft of session cookies, account takeover, or unauthorized actions on behalf of the user.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Immediately update Silverstripe CMS to version 6.2.1 or later. This can be done via Composer with 'composer require silverstripe/cms:^6.2.1' or through the CMS admin interface if applicable.

Hi! I’m here to help you understand CVE-2026-54717. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70