silverstripe/userforms vulnerabilities

UserForms enables CMS users to create dynamic forms via a drag and drop interface and without getting involved in any PHP code

Registry
Composer
Latest
7.1.3
License
BSD-3-Clause
Source
github.com/silverstripe/silverstripe-userforms (opens the source repository in a new tab)

3 known advisories

The latest version, 7.1.3, is not affected by any of them. Projects on older versions may be.

Update to the latest version:composer require silverstripe/userforms:^7.1.3

Security advisories for silverstripe/userforms

  • HighGHSA-g8wr-r2v2-vqc627 Aug 2026

    silverstripe/userforms vulnerable to remote code execution via userforms email subject

    Affected
    <6.4.9 · >=7.0.0 <7.0.7 · >=7.1.0 <7.1.1
    Fixed in
    6.4.9, 7.0.7, 7.1.1
  • MediumGHSA-55pp-293f-336528 May 2024

    silverstripe/userforms file upload exposure on UserForms module

    Affected
    <3.0.0
    Fixed in
    3.0.0
  • HighGHSA-592m-4533-rxq924 May 2022

    SilverStripe Folders migrated from 3.x may be unsafe to upload to

    Affected
    >=5.0.0 <5.4.2
    Fixed in
    5.4.2

Which of your client projects still run an old silverstripe/userforms?

NPMscan reads the composer.lock in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other Composer packages

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the Composer registry.