Silverstripe Framework has a XSS vulnerability in HTML editor

TRUNG BÌNH 5.4CVE-2025-30148 · GHSA-rhx4-hvx9-j387 · Công bố 10/04/2025 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2025-30148 là lỗ hổng mức TRUNG BÌNH (CVSS 5.4) ảnh hưởng silverstripe/framework, framework (silverstripe).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.29%, cao hơn 21.8% các lỗ hổng khác.
Cách xử lý: cập nhật lên 5.3.23 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
silverstripe/framework Packagist	`< 5.3.23`	`5.3.23`
framework silverstripe	`≤ 5.3.23`	Chưa có bản vá

Mô tả

Impact

A bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't catch it.

The server-side sanitisation logic has been updated to sanitise against this attack.

Reported by

James Nicoll from Fujitsu Cyber

References

https://www.silverstripe.org/download/security-releases/cve-2025-30148

Mô tả của NVD

Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. Prior to 5.3.23, bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitized on the client-side, but server-side sanitization doesn't catch it. The server-side sanitization logic has been updated to sanitize against this attack. This vulnerability is fixed in 5.3.23.