PT-2025-15980 · Silverstripe · Silverstripe Elemental

Emteknetnz · Published 2025-04-10 · Updated 2025-04-10 · CVE-2025-25197

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Silverstripe Elemental versions prior to 5.3.12

Description: The issue arises from the failure to cast input prior to including it in the grid field, allowing an elemental block to include an XSS payload. This payload can be executed when viewing the "Content blocks in use" report. The vulnerability is specific to this report.

Recommendations: For versions prior to 5.3.12, update to version 5.3.12 to resolve the issue. As a temporary workaround, consider restricting access to the "Content blocks in use" report until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-25197

GHSA-X8XM-C7P8-2PJ2

Affected Products

Silverstripe Elemental

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25197.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/dnadesign/silverstripe-elemental/CVE-2025-25197.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-25197 · Security Note
• https://osv.dev/vulnerability/GHSA-x8xm-c7p8-2pj2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-25197 · Vendor Advisory
• https://github.com/silverstripe/silverstripe-elemental · Note
• https://github.com/silverstripe/silverstripe-elemental/commit/34ff4ed498ccab94cc5f55ef9a56c37f491eda1d · Note
• https://github.com/silverstripe/silverstripe-elemental/pull/1345 · Note
• https://github.com/silverstripe/silverstripe-elemental/security/advisories/GHSA-x8xm-c7p8-2pj2 · Note
• https://twitter.com/CVEnew/status/1910335835767177555 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1910446878178541953 · Twitter Post
• https://t.me/cvedetector/22667 · Telegram Post
• https://t.me/cvetracker/21324 · Telegram Post
• https://silverstripe.org/download/security-releases/CVE-2025-25197 · Note
• https://silverstripe.org/download/security-releases/cve-2025-25197 · Note