DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-55779: CVE-2026-55779: Stored Cross-Site Scripting (XSS) in Silverstripe Archive Admin Restore

#security #cve #cybersecurity

CVE-2026-55779: Stored Cross-Site Scripting (XSS) in Silverstripe Archive Admin Restore

Vulnerability ID: CVE-2026-55779
CVSS Score: 5.4
Published: 2026-08-28

A Stored Cross-Site Scripting (XSS) vulnerability exists in the silverstripe/versioned package prior to version 3.2.1. When an administrator restores an archived page containing a crafted Title or URLSegment, the generated restoration message is rendered as CAST_HTML without proper sanitization. This allows malicious JavaScript to execute in the administrator's browser session, compromising the confidentiality and integrity of the CMS dashboard.

TL;DR

Unescaped user input in the RestoreAction helper leads to stored XSS inside the Silverstripe CMS administrative interface during page restoration actions.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79
  • Attack Vector: Network (AV:N)
  • CVSS Score: 5.4 (Medium)
  • EPSS Score: Not Available
  • Impact: Stored Cross-Site Scripting / Session Hijacking
  • Exploit Status: PoC Available
  • KEV Status: Not Listed

Affected Systems

  • Silverstripe CMS
  • Silverstripe Versioned Module
  • silverstripe/versioned: < 3.2.1 (Fixed in: 3.2.1)

Code Analysis

Commit: 6e30a2c

Escape restore messages rendered as CAST_HTML

Commit: 03c15b3

Add regression tests for RestoreAction escaping

Exploit Details

  • GitHub Advisory: Stored XSS PoC details via title-based and button-based vectors

Mitigation Strategies

  • Upgrade silverstripe/versioned dependency to 3.2.1 or higher.
  • Perform manual XML escaping via Convert::raw2xml inside RestoreAction.php as a hotfix.
  • Audit versioned database tables for HTML tags and attribute payloads.

Remediation Steps:

  1. Run 'composer update silverstripe/versioned' to pull the patched version.
  2. Verify in composer.lock that the installed version is 3.2.1 or higher.
  3. Execute detection SQL queries on SiteTree_Versions table to identify persistent payloads.

References

Read the full report for CVE-2026-55779 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)