What is GHSA-gvrw-qqp5-jgc5?

GHSA-gvrw-qqp5-jgc5 is a security advisory published by GitHub Security Advisories with Medium severity. Silverstripe Framework: Possible XSS attack through media embed

Which CVE IDs does GHSA-gvrw-qqp5-jgc5 cover?

GHSA-gvrw-qqp5-jgc5 covers the following CVE IDs: CVE-2026-54720. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gvrw-qqp5-jgc5?

GHSA-gvrw-qqp5-jgc5 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-gvrw-qqp5-jgc5?

GHSA-gvrw-qqp5-jgc5 affects 1 product, including: composer/silverstripe/framework:\u003c 6.2.2.

GHSA-gvrw-qqp5-jgc5MediumCVSS 5.4

Silverstripe Framework: Possible XSS attack through media embed

Vendor

GitHub Security Advisories

Published

August 27, 2026

Last Modified

August 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-54720 →

📋 Description

Impact

The "Insert media from web" functionality in the CMS is vulnerable to XSS from a specially crafted embed.

Reported by

Jack Wallace from Bastion Security

🎯 Affected products1

composer/silverstripe/framework:< 6.2.2

🔗 References (8)

https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-gvrw-qqp5-jgc5
https://nvd.nist.gov/vuln/detail/CVE-2026-54720
https://github.com/silverstripe/silverstripe-framework/pull/11993
https://github.com/silverstripe/silverstripe-framework/commit/1bcb02adfc365c6436dc26ab2f6dd32d97f3979b
https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2026-54720.yaml
https://github.com/silverstripe/silverstripe-framework/releases/tag/6.2.2
https://www.silverstripe.org/download/security-releases/cve-2026-54720
https://github.com/advisories/GHSA-gvrw-qqp5-jgc5