Is silverstripe/framework 5.2 vulnerable?

Composer · 23 releases from 5.2.0 to 5.2.22 · latest silverstripe/framework is 6.3.1 · checked 1 Nov 2026

Yes: 7 known advisories

Yes. silverstripe/framework 5.2.22, the last 5.2 release, is affected by 7 known security advisories (5 medium, 2 low), including CVE-2026-54720, CVE-2025-30148, CVE-2024-53277. 2 more affect earlier 5.2.x releases. Upgrade to 6.2.2 or later to fix all of them.

Upgrade with:composer require silverstripe/framework:^6.2.2

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting silverstripe/framework 5.2.22

  • MediumCVE-2026-54720GHSA-gvrw-qqp5-jgc527 Aug 2026

    Silverstripe Framework: Possible XSS attack through media embed

    Affected
    <6.2.2
    Fixed in
    6.2.2
  • MediumGHSA-256q-hx8w-xcqx10 Apr 2025

    Silverstripe Framework user enumeration via timing attack on login and password reset forms

    Affected
    >=4.0.0 <5.3.23
    Fixed in
    5.3.23
  • MediumCVE-2025-30148GHSA-rhx4-hvx9-j38710 Apr 2025

    Silverstripe Framework has a XSS vulnerability in HTML editor

    Affected
    <5.3.23
    Fixed in
    5.3.23
  • LowGHSA-74j9-xhqr-6qv323 Jan 2025

    Reflected Cross Site Scripting (XSS) in error message

    Affected
    <5.3.8
    Fixed in
    5.3.8
  • LowGHSA-mqf3-qpc3-g26q14 Jan 2025

    Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message

    Affected
    <5.3.8
    Fixed in
    5.3.8
  • MediumCVE-2024-53277GHSA-ff6q-3c9c-6cf514 Jan 2025

    Silverstripe Framework has a XSS in form messages

    Affected
    <5.3.8
    Fixed in
    5.3.8
  • MediumCVE-2024-47605GHSA-7cmp-cgg8-4c8214 Jan 2025

    Silverstripe Framework has a XSS via insert media remote file oembed

    Affected
    <5.3.8
    Fixed in
    5.3.8

Fixed within 5.2.x, affecting earlier releases

  • MediumGHSA-52cw-pvq9-9m5v17 Jul 2024

    Silverstripe uses TinyMCE which allows svg files linked in object tags

    Affected
    <5.2.16
    Fixed in
    5.2.16
  • MediumCVE-2024-32981GHSA-chx7-9x8h-r5mg17 Jul 2024

    Silverstripe Framework has a Cross-site Scripting vulnerability with encoded payload

    Affected
    <5.2.16
    Fixed in
    5.2.16

Which of your client projects are still on silverstripe/framework 5.2?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact silverstripe/framework version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other silverstripe/framework versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.