Description
Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list view, because page titles are rendered into the breadcrumb trail without being escaped. This issue is fixed in 6.2.1.
References (4)
Core 4
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/silverstripe/silverstripe-cms/security/advisories/GHSA-w3cp-g2pf-65wh
X_Refsource_Misc x_refsource_misc
https://github.com/silverstripe/silverstripe-cms/pull/3175
X_Refsource_Misc x_refsource_misc
https://github.com/silverstripe/silverstripe-cms/commit/62f9912baa18c80304f3fa8b6eca71bb5dc2d21e
X_Refsource_Misc x_refsource_misc
https://github.com/silverstripe/silverstripe-cms/releases/tag/6.2.1
Scores
CVSS v3
5.4
EPSS
0.0024
EPSS Percentile
15.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
Status
published
Products (2)
silverstripe/cms
0 - 6.2.1Packagist
silverstripe/silverstripe-cms
< 6.2.1
Published
Aug 06, 2026
Tracked Since
Aug 07, 2026