DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-54721: CVE-2026-54721: Remote Code Execution via Server-Side Template Injection in Silverstripe UserForms

#security #cve #cybersecurity

CVE-2026-54721: Remote Code Execution via Server-Side Template Injection in Silverstripe UserForms

Vulnerability ID: CVE-2026-54721
CVSS Score: 8.8
Published: 2026-08-27

A Server-Side Template Injection (SSTI) vulnerability in the Silverstripe UserForms module allows authenticated CMS users with basic form configuration privileges to achieve remote code execution (RCE). The flaw resides in the processing of the email recipient subject field, where user-supplied template translation tags are evaluated by the template engine, leading to arbitrary PHP execution via dynamic variable interpolation.

TL;DR

Authenticated CMS users can execute arbitrary PHP code on the server by embedding crafted translation tags in the form email subject field, which are evaluated dynamically during form submission.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-94: Improper Control of Generation of Code ('Code Injection')
  • Attack Vector: Network (AV:N)
  • CVSS Score: 8.8 (High)
  • Exploit Status: Proof of Concept available in tests
  • KEV Status: Not Listed

Affected Systems

  • Silverstripe CMS with UserForms module version < 6.4.9
  • Silverstripe CMS with UserForms module version >= 7.0.0, < 7.0.7
  • Silverstripe CMS with UserForms module version >= 7.1.0, < 7.1.1
  • silverstripe/silverstripe-userforms: < 6.4.9 (Fixed in: 6.4.9)
  • silverstripe/silverstripe-userforms: >= 7.0.0, < 7.0.7 (Fixed in: 7.0.7)
  • silverstripe/silverstripe-userforms: >= 7.1.0, < 7.1.1 (Fixed in: 7.1.1)

Mitigation Strategies

  • Apply security updates to the UserForms module and core template engine.
  • Enforce execution control restrictions on upload folders like the assets directory.
  • Implement restrictive RBAC policies to ensure only trusted administrators can configure form emails.

Remediation Steps:

  1. Verify the current version of silverstripe/silverstripe-userforms using the command: composer show silverstripe/silverstripe-userforms
  2. Update Composer packages to pull down the latest patched security releases.
  3. Run 'dev/build' to clear the template compilation cache on the target server.
  4. Audit active CMS accounts and restrict write access to UserForms configurations.

Read the full report for CVE-2026-54721 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)