silverstripe/cms vulnerabilities

The SilverStripe Content Management System

Registry
Composer
Latest
6.2.5
License
BSD-3-Clause
Source
github.com/silverstripe/silverstripe-cms (opens the source repository in a new tab)

16 known advisories

The latest version, 6.2.5, is not affected by any of them. Projects on older versions may be.

Update to the latest version:composer require silverstripe/cms:^6.2.5

Security advisories for silverstripe/cms

  • MediumGHSA-w3cp-g2pf-65wh6 Aug 2026

    Silverstripe: XSS in breadcrumbs in page list view

    Affected
    <6.2.1
    Fixed in
    6.2.1
  • HighGHSA-3mm9-2p44-rw3922 May 2024

    Silverstripe SiteTree Creation Permission Vulnerability

    Affected
    >=3.0.0 <3.0.12 · >=3.1.0 <3.1.11
    Fixed in
    3.0.12, 3.1.11
  • MediumGHSA-r97r-64vp-fghm22 May 2024

    Silverstripe XSS vulnerability via VirtualPage

    Affected
    >=3.1.0 <3.1.10
    Fixed in
    3.1.10
  • MediumGHSA-6hh6-59j2-qrxw22 May 2024

    Silverstripe History XSS Vulnerability

    Affected
    >=3.1.0 <3.1.10
    Fixed in
    3.1.10
  • MediumGHSA-pp74-g2q5-j4jf21 Nov 2022

    Silverstipe CMS Stored XSS in custom meta tags

    Affected
    >=4.0.0 <4.11.3
    Fixed in
    4.11.3
  • HighGHSA-h77w-655f-6j3m24 May 2022

    Silverstripe CMS malicious file upload enables script execution

    Affected
    <=4.5.0
    Fixed in
    No fix released
  • MediumGHSA-2pw2-qpcp-m47x24 May 2022

    Silverstripe CMS XSS Vulnerability

    Affected
    <=4.5.0
    Fixed in
    No fix released
  • HighGHSA-gm5x-hpmw-xpxg24 May 2022

    Silverstripe CMS information disclosure

    Affected
    <=4.5.0
    Fixed in
    No fix released
  • MediumGHSA-gv6c-59h4-9pmg17 May 2022

    Silverstripe CMS Arbitrary Code Execution

    Affected
    >=2.4.0 <2.4.6
    Fixed in
    2.4.6
  • MediumGHSA-j696-6m57-mcrv17 May 2022

    Silverstripe CMS XSS Vulnerability

    Affected
    <3.6.1
    Fixed in
    3.6.1
  • MediumGHSA-fwhr-g5r4-xgxf17 May 2022

    Silverstripe CMS User Enumeration

    Affected
    <3.5.5 · >=3.6 <3.6.1
    Fixed in
    3.5.5, 3.6.1
  • MediumGHSA-fh35-p8ph-p54514 May 2022

    Silverstripe CMS Open Redirect

    Affected
    <=3.1.13
    Fixed in
    No fix released
  • LowGHSA-wg4m-vvp6-2hc514 May 2022

    SilverStripe vulnerable to Cross-site Scripting

    Affected
    <2.3.5
    Fixed in
    2.3.5
  • MediumGHSA-xmjh-wjc5-wg4h14 May 2022

    Silverstripe CMS XSS Vulnerability

    Affected
    <3.4.4 · >=3.5.0 <3.5.2
    Fixed in
    3.4.4, 3.5.2
  • MediumGHSA-gvc8-xjfp-656913 May 2022

    Silverstripe CMS XSS Vulnerability

    Affected
    <3.1.16 · >=3.2.0 <3.2.1
    Fixed in
    3.1.16, 3.2.1
  • CriticalGHSA-cg8j-8w52-735v12 Nov 2019

    Missing warning can lead to unauthenticated admin access in SilverStripe

    Affected
    >=4.4.0 <4.4.4
    Fixed in
    4.4.4

Which of your client projects still run an old silverstripe/cms?

NPMscan reads the composer.lock in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other Composer packages

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the Composer registry.