GHSA-x8xm-c7p8-2pj2MediumCVSS 5.4
Silverstripe cross-site scripting (XSS) attack in elemental "Content blocks in use" report
🔗 CVE IDs covered (1)
📋 Description
An elemental block can include an XSS payload, which can be executed when viewing the "Content blocks in use" report.
The vulnerability is specific to that report and is a result of failure to cast input prior to including it in the grid field.
References
- https://www.silverstripe.org/download/security-releases/CVE-2025-25197
🎯 Affected products1
- composer/dnadesign/silverstripe-elemental:>= 2.1.2, < 5.3.12
🔗 References (7)
- https://github.com/silverstripe/silverstripe-elemental/security/advisories/GHSA-x8xm-c7p8-2pj2
- https://github.com/silverstripe/silverstripe-elemental/pull/1345
- https://github.com/FriendsOfPHP/security-advisories/blob/master/dnadesign/silverstripe-elemental/CVE-2025-25197.yaml
- https://www.silverstripe.org/download/security-releases/cve-2025-25197
- https://nvd.nist.gov/vuln/detail/CVE-2025-25197
- https://github.com/silverstripe/silverstripe-elemental/commit/34ff4ed498ccab94cc5f55ef9a56c37f491eda1d
- https://github.com/advisories/GHSA-x8xm-c7p8-2pj2