CVE-2026-54721

Received Received - Intake

Remote Code Execution in Silverstripe UserForms

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: GitHub, Inc.

Description

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user with permission to configure a UserForms email recipient can use the subject field to run arbitrary code on the server, compromising confidentiality, integrity, and availability. This issue is fixed in versions 6.4.9, 7.0.7, and 7.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-27

Generated

2026-08-28

AI Q&A

2026-08-28

EPSS Evaluated

N/A

NVD

CVE-2026-54721

Affected Vendors & Products

Vendor	Product	Version / Range
silverstripe	userforms	6.0.0
silverstripe	userforms	6.4.9
silverstripe	userforms	From 6.0.0 (inc) to 6.4.9 (inc)
silverstripe	userforms	7.0.7
silverstripe	userforms	7.1.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This is a Remote Code Execution (RCE) vulnerability in the SilverStripe UserForms module affecting versions before 6.4.9, 7.0.7, and 7.1.1. An authenticated CMS user with permission to configure email recipients can inject malicious PHP code into the email subject field. The vulnerability occurs because the subject field improperly evaluates template tags like <%t %>, allowing arbitrary server-side code execution. This compromises server confidentiality, integrity, and availability.

Detection Guidance

To detect this vulnerability, check if your Silverstripe UserForms version is below 6.4.9, 7.0.7, or 7.1.1. Use commands like 'composer show silverstripe/userforms' to verify the installed version. If vulnerable, update immediately to a patched version.

Impact Analysis

An attacker with CMS access could execute arbitrary commands on the server, potentially stealing sensitive data, installing malware, or disrupting services. This could lead to complete system compromise, data breaches, or unauthorized modifications to the website or backend systems.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements and HIPAA's security rules. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Update Silverstripe UserForms to version 6.4.9, 7.0.7, or 7.1.1 or later to patch the RCE vulnerability in the email recipient subject field.

Hi! I’m here to help you understand CVE-2026-54721. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70