CVE-2026-54720: CVE-2026-54720: Stored Cross-Site Scripting (XSS) via Sandbox Bypass in Silverstripe Framework

#security #cve #cybersecurity

CVE-2026-54720: Stored Cross-Site Scripting (XSS) via Sandbox Bypass in Silverstripe Framework

Vulnerability ID: CVE-2026-54720
CVSS Score: 5.4
Published: 2026-08-27

CVE-2026-54720 is a stored Cross-Site Scripting (XSS) vulnerability inside the Silverstripe Framework's media shortcode processor. Due to a flawed performance optimization, HTML inputs containing two or fewer opening angle brackets bypassed security sandboxing. This flaw allows authenticated or lower-privileged users to inject administrative panel payloads that execute arbitrary client-side JavaScript when viewed by system administrators.

TL;DR

A design shortcut in Silverstripe Framework's iframe sandboxing allows attackers to bypass security filters using simple single-tag iframe embeds, enabling unauthenticated or lower-privileged administrative session takeover.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-79
Attack Vector: Network (AV:N)
CVSS v3.1 Score: 5.4
EPSS Score: 0.00263 (Percentile: 17.73%)
Impact: Stored XSS leading to Administrative Session Compromise
Exploit Status: Proof of Concept (PoC) documented
KEV Status: Not listed in CISA KEV Catalog

Affected Systems

Silverstripe Content Management System (CMS) deployments utilising the silverstripe/framework composer package.
silverstripe-framework: < 6.2.2 (Fixed in: 6.2.2)

Code Analysis

Commit: 1bcb02a

Fix XSS in EmbedShortcodeProvider sandboxHtml by sanitizing attributes when returning raw HTML elements.

--- a/src/View/Shortcodes/EmbedShortcodeProvider.php
+++ b/src/View/Shortcodes/EmbedShortcodeProvider.php
@@ -118,1 +118,1 @@
-        if (substr_count($html, '<') <= 2) {
-            return $html;
+        if (substr_count($html, '<') <= 2) {
+            return EmbedShortcodeProvider::removeDangerousAttributes($html);
+        }

Mitigation Strategies

Upgrade the silverstripe/framework composer dependency to version 6.2.2 or above.
Deploy WAF rules to intercept raw iframe submissions containing event handlers or non-standard URI schemes.
Implement a robust Content Security Policy (CSP) prohibiting unsanitized inline scripts ('unsafe-inline') and restricting frame origins.

Remediation Steps:

Navigate to the project root directory.
Run the composer command: composer update silverstripe/framework to pull down the patch.
Clear the framework cache configuration to ensure the updated EmbedShortcodeProvider is initialized.
Verify the application templates and media embed functions in a staging environment.

References

Read the full report for CVE-2026-54720 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community