Cross-Site Scripting Vulnerability in Silverstripe CMS by Silverstripe
CVE-2026-54717

5.4MEDIUM

Key Information:

Vendor

Silverstripe

Status
Silverstripe-cms
Vendor
CVE Published:
6 August 2026

What is CVE-2026-54717?

Prior to version 6.2.1, Silverstripe CMS, an open-source content management system, is vulnerable to cross-site scripting (XSS) in its breadcrumb feature when viewed in the page list view. This vulnerability allows page titles to be rendered into the breadcrumb trail without appropriate escaping, potentially enabling attackers to execute malicious scripts in the context of users' browsers. The issue has been addressed in the 6.2.1 release, where proper escaping mechanisms were implemented to secure the breadcrumb rendering.

Affected Version(s)

silverstripe-cms < 6.2.1

References

https://github.com/silverstripe/silverstripe-cms/security...
x_refsource_CONFIRM
https://github.com/silverstripe/silverstripe-cms/pull/3175
x_refsource_MISC
https://github.com/silverstripe/silverstripe-cms/commit/6...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.