PT-2026-54846 · Silverstripe · Silverstripe/Framework

Jack Wallace · Published 2026-07-01 · Updated 2026-07-02 · CVE-2026-54720

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Silverstripe Framework versions prior to 6.2.2

Description The "Insert media from web" functionality in the CMS is susceptible to Cross-Site Scripting (XSS), a technique where malicious scripts are injected into trusted websites, when processing a specially crafted embed.

Recommendations Update to version 6.2.2.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-54720

GHSA-GVRW-QQP5-JGC5

Affected Products

Silverstripe/Framework

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54720.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-54720 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54720 · Security Note
• https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-gvrw-qqp5-jgc5 · Note
• https://t.me/cveNotify/185398 · Telegram Post
• https://silverstripe.org/download/security-releases/cve-2026-54720 · Note