GHSA-gvrw-qqp5-jgc5

Silverstripe Framework: Possible XSS attack through media embed

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-54720

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	silverstripe/framework	< 6.2.2	6.2.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The "Insert media from web" functionality in the CMS is vulnerable to XSS from a specially crafted embed. ### Reported by Jack Wallace from Bastion Security

References

External links from the advisory. They lead to third-party sites.

https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-gvrw-qqp5-jgc5 web
https://nvd.nist.gov/vuln/detail/CVE-2026-54720 advisory
https://github.com/silverstripe/silverstripe-framework/pull/11993 web
https://github.com/silverstripe/silverstripe-framework/commit/1bcb02adfc365c6436dc26ab2f6dd32d97f3979b web
https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2026-54720.yaml web
https://github.com/silverstripe/silverstripe-framework package
https://github.com/silverstripe/silverstripe-framework/releases/tag/6.2.2 web
https://www.silverstripe.org/download/security-releases/cve-2026-54720 web