Log in Start free

Vulnerability · Published Aug 27, 2026 · Assigned by GitHub_M

CVE-2026-54721Silverstripe UserForms: Remote code execution via userforms email subject

High 8.8

In plain English

A high-severity code injection in silverstripe-userforms from silverstripe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.7%top 45.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user with permission to configure a UserForms email recipient can use the subject field to run arbitrary code on the server, compromising confidentiality, integrity, and availability. This issue is fixed in versions 6.4.9, 7.0.7, and 7.1.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistsilverstripe/userforms6.4.9GHSA-g8wr-r2v2-vqc6
Packagistsilverstripe/userforms7.0.7GHSA-g8wr-r2v2-vqc6
Packagistsilverstripe/userforms7.1.1GHSA-g8wr-r2v2-vqc6

Affected products (as reported)

VendorProductVersions
silverstripe silverstripe-userforms < 6.4.9>= 7.0.0, < 7.0.7>= 7.1.0, < 7.1.1

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References