# silverstripe/framework (Packagist) vulnerabilities

37 known vulnerabilities (1 high, 12 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/silverstripe/framework

## Advisories (37)

### [CVE-2026-54720](https://cve.now/CVE-2026-54720): Silverstripe Framework: Possible XSS attack through media embed

- Severity: Medium 5.4
- Published: Jul 1, 2026
- Affected: fixed in 6.2.2.

### [CVE-2025-30148](https://cve.now/CVE-2025-30148): Silverstripe Framework has a XSS vulnerability in HTML editor

- Severity: Medium 5.4
- Published: Apr 10, 2025
- Affected: fixed in 5.3.23.

### [CVE-2024-53277](https://cve.now/CVE-2024-53277): Cross-site Scripting in form messages in silverstripe framework

- Severity: Medium 5.4
- Published: Jan 14, 2025
- Affected: fixed in 5.3.8.

### [CVE-2024-47605](https://cve.now/CVE-2024-47605): Cross-site Scripting via insert media remote file oembed in silverstripe-asset-admin

- Severity: Medium 5.4
- Published: Jan 14, 2025
- Affected: fixed in 5.3.8.

### [CVE-2024-32981](https://cve.now/CVE-2024-32981): Cross-site Scripting vulnerability with encoded payload in silverstripe/framework

- Severity: Medium 5.4
- Published: Jul 17, 2024
- Affected: fixed in 5.2.16.

### [CVE-2023-48714](https://cve.now/CVE-2023-48714): Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter

- Severity: Medium 4.3
- Published: Jan 23, 2024
- Affected: fixed in 4.13.39; from 5.0.0, fixed in 5.1.11.

### [CVE-2023-22729](https://cve.now/CVE-2023-22729): Silverstripe Framework has open redirect vulnerability on CMSSecurity relogin screen

- Severity: Medium 5.4
- Published: Apr 26, 2023
- Affected: fixed in 4.12.5.

### [CVE-2023-22728](https://cve.now/CVE-2023-22728): Silverstripe Framework has missing permission check of canView in GridFieldPrintButton

- Severity: Medium 4.3
- Published: Apr 26, 2023
- Affected: fixed in 4.12.5.

### [CVE-2022-37430](https://cve.now/CVE-2022-37430): Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link (issue 2 of 2).

- Severity: Medium 5.4
- Published: Nov 23, 2022
- Affected: from 4.0.0, fixed in 4.11.13.

### [CVE-2022-37429](https://cve.now/CVE-2022-37429): Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 2) via JavaScript payload to the href attribute of a link by…

- Severity: Medium 5.4
- Published: Nov 23, 2022
- Affected: from 4.0.0, fixed in 4.11.13.

### [CVE-2022-38724](https://cve.now/CVE-2022-38724): Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow…

- Severity: Medium 5.4
- Published: Nov 22, 2022
- Affected: from 4.0.0, fixed in 4.11.13.

### [CVE-2022-38462](https://cve.now/CVE-2022-38462): Silverstripe silverstripe/framework through 4.11 is vulnerable to XSS by carefully crafting a return URL on a /dev/build or…

- Severity: Medium 6.1
- Published: Nov 22, 2022
- Affected: from 4.0.0, fixed in 4.11.13.

### [CVE-2022-38148](https://cve.now/CVE-2022-38148): Silverstripe silverstripe/framework through 4.11 allows SQL Injection.

- Severity: High 8.8
- Published: Nov 21, 2022
- Affected: from 4.0.0, fixed in 4.10.11; from 4.11.0, fixed in 4.11.14.

### [CVE-2022-28803](https://cve.now/CVE-2022-28803): In SilverStripe Framework through 2022-04-07, Stored XSS can occur in javascript link tags added via XMLHttpRequest (XHR).

- Severity: Unrated
- Published: Jun 29, 2022
- Affected: from 4.0.0, fixed in 4.10.9.

### [CVE-2022-25238](https://cve.now/CVE-2022-25238): Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by…

- Severity: Unrated
- Published: Jun 28, 2022
- Affected: from 4.0.0, fixed in 4.10.9.

### [CVE-2021-41559](https://cve.now/CVE-2021-41559): Silverstripe silverstripe/framework 4.8.1 has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted XML…

- Severity: Unrated
- Published: Jun 28, 2022
- Affected: from 4.0.0, fixed in 4.10.9.

### [CVE-2020-25817](https://cve.now/CVE-2020-25817): SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser.

- Severity: Unrated
- Published: Jun 8, 2021
- Affected: from 4.0.0, fixed in 4.7.4.

### [CVE-2020-26138](https://cve.now/CVE-2020-26138): In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation.

- Severity: Unrated
- Published: Jun 8, 2021
- Affected: from 3.0.0, fixed in 4.7.4.

### [CVE-2020-9311](https://cve.now/CVE-2020-9311): In SilverStripe through 4.5, malicious users with a valid Silverstripe CMS login (usually CMS access) can craft profile information which…

- Severity: Unrated
- Published: Jul 15, 2020
- Affected: from 3.0.0, fixed in 3.7.5.

### [CVE-2020-6164](https://cve.now/CVE-2020-6164): In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/framework module can be used to disclose…

- Severity: Unrated
- Published: Jul 15, 2020
- Affected: from 4.0.0, fixed in 4.4.7; from 4.5.0, fixed in 4.5.4.

### [CVE-2019-19326](https://cve.now/CVE-2019-19326): Silverstripe CMS sites through 4.4.4 which have opted into HTTP Cache Headers on responses served by the framework's HTTP layer can be…

- Severity: Unrated
- Published: Jul 15, 2020
- Affected: from 4.0.0, fixed in 4.4.7; from 4.5.0, fixed in 4.5.4; from 3.0.0, fixed in 3.7.5.

### [CVE-2020-9280](https://cve.now/CVE-2020-9280): In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads"…

- Severity: Unrated
- Published: Apr 15, 2020
- Affected: from 4.0.0, fixed in 4.4.6.

### [CVE-2019-12246](https://cve.now/CVE-2019-12246): SilverStripe through 4.3.3 allows a Denial of Service on flush and development URL tools.

- Severity: Unrated
- Published: Feb 19, 2020
- Affected: from 4.0.0, fixed in 4.4.0; through 3.6.

### [CVE-2019-19325](https://cve.now/CVE-2019-19325): SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms.

- Severity: Unrated
- Published: Feb 17, 2020
- Affected: from 4.5.0, fixed in 4.5.2; from 4.0.0, fixed in 4.4.5.

### [CVE-2019-16409](https://cve.now/CVE-2019-16409): In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished versions of files are publicly exposed to anyone who can…

- Severity: Unrated
- Published: Sep 26, 2019
- Affected: from 4.0.0, fixed in 4.3.5; from 4.4.0, fixed in 4.4.4.

### [CVE-2019-12617](https://cve.now/CVE-2019-12617): In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution.

- Severity: Unrated
- Published: Sep 26, 2019
- Affected: from 4.4.0, fixed in 4.4.4; from 4.3.0, fixed in 4.3.5.

### [CVE-2019-14272](https://cve.now/CVE-2019-14272): In SilverStripe asset-admin 4.0, there is XSS in file titles managed through the CMS.

- Severity: Unrated
- Published: Sep 26, 2019
- Affected: from 4.0.0, fixed in 4.3.5; from 4.4.0, fixed in 4.4.4.

### [CVE-2019-14273](https://cve.now/CVE-2019-14273): In SilverStripe assets 4.0, there is broken access control on files.

- Severity: Unrated
- Published: Sep 26, 2019
- Affected: from 4.0.0, fixed in 4.3.5; from 4.4.0, fixed in 4.4.4.

### [CVE-2019-12205](https://cve.now/CVE-2019-12205): SilverStripe through 4.3.3 has Flash Clipboard Reflected XSS.

- Severity: Unrated
- Published: Sep 25, 2019
- Affected: from 3.0.0, fixed in 4.3.5; from 4.4.0-rc1, fixed in 4.4.4.

### [CVE-2019-12203](https://cve.now/CVE-2019-12203): SilverStripe through 4.3.3 allows session fixation in the "change password" form.

- Severity: Unrated
- Published: Sep 25, 2019
- Affected: from 3.7.0, fixed in 3.7.4; from 4.4.0, fixed in 4.4.4; from 3.6.0, fixed in 3.6.8; from 4.0.0, fixed in 4.3.5.

### [CVE-2019-12245](https://cve.now/CVE-2019-12245): SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile().

- Severity: Unrated
- Published: Sep 25, 2019
- Affected: fixed in 3.6.8; from 3.7.0, fixed in 3.7.4; from 4.0.0, fixed in 4.3.6; from 4.4.0, fixed in 4.4.4.

### [CVE-2019-12204](https://cve.now/CVE-2019-12204): In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access.

- Severity: Unrated
- Published: Sep 25, 2019
- Affected: from 4.1.0, fixed in 4.3.5.

### [CVE-2019-5715](https://cve.now/CVE-2019-5715): All versions of SilverStripe 3 prior to 3.6.7 and 3.7.3, and all versions of SilverStripe 4 prior to 4.0.7, 4.1.5, 4.2.4, and 4.3.1 allows…

- Severity: Unrated
- Published: Apr 11, 2019
- Affected: from 3.0.0, fixed in 3.6.7; from 4.0.0, fixed in 4.0.7; from 3.7.0, fixed in 3.7.3; from 4.1.0, fixed in 4.1.5; from 4.2.0, fixed in 4.2.4; from 4.3.0, fixed in 4.3.1.

### [CVE-2017-18049](https://cve.now/CVE-2017-18049): In the CSV export feature of SilverStripe before 3.5.6, 3.6.x before 3.6.3, and 4.x before 4.0.1, it's possible for the output to contain…

- Severity: Unrated
- Published: Jan 23, 2018
- Affected: fixed in 3.5.6; from 3.6.0, fixed in 3.6.3; from 4.0.0, fixed in 4.0.1.

### [CVE-2015-5062](https://cve.now/CVE-2015-5062): Open redirect vulnerability in SilverStripe CMS & Framework 3.1.13 allows remote attackers to redirect users to arbitrary web sites and…

- Severity: Unrated
- Published: Jun 24, 2015
- Affected: through 3.1.13.

### [CVE-2012-4968](https://cve.now/CVE-2012-4968): Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow remote attackers to…

- Severity: Unrated
- Published: Sep 17, 2012
- Affected: from 2.3, fixed in 2.3.13; from 2.4, fixed in 2.4.7.

### [CVE-2010-1593](https://cve.now/CVE-2010-1593): Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe before 2.3.5 allow remote attackers to inject arbitrary web script or…

- Severity: Unrated
- Published: Apr 28, 2010
- Affected: fixed in 2.3.5.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/silverstripe/framework
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.