Description

Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list view, because page titles are rendered into the breadcrumb trail without being escaped. This issue is fixed in 6.2.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-06T22:17:44.543Z",
  "pubdate": "2026-08-06T22:17:44.543Z",
  "executiveSummary": "A cross-site scripting vulnerability exists within Silverstripe CMS prior to version 6.2.1, specifically affecting page breadcrumbs displayed in the page list view. The vulnerability arises due to the improper handling of user-supplied page titles, which are rendered directly into the breadcrumb trail without appropriate output escaping.\nSuccessful exploitation of this flaw allows a malicious actor with the capability to create or modify page titles to inject arbitrary JavaScript into the application context. When an administrator or privileged user views the vulnerable page list view, the injected payload executes within their browser session. This can lead to unauthorized actions performed on behalf of the victim, session hijacking, or further compromise of the content management system.\nThe risk profile for this vulnerability is elevated due to the administrative context in which the page list view is typically accessed, potentially granting elevated capabilities to an attacker upon successful exploitation. Remediation requires updating the affected software to the patched version where proper output encoding is enforced.",
  "technicalDetails": "The root cause of the vulnerability resides in the lack of proper output encoding or sanitization mechanisms applied to page titles before they are rendered into the breadcrumb trail within the administrative interface. Specifically, when the page list view compiles the breadcrumb trail for hierarchical content representation, raw string values representing page titles are interpolated directly into the Document Object Model (DOM) or HTML response without prior sanitization.\nThe vulnerable component is the page breadcrumb rendering logic utilized by the Silverstripe CMS page list view. Affected versions comprise all releases of Silverstripe CMS prior to version 6.2.1. The flaw is resolved in version 6.2.1.\nThe exploitation method requires an attacker to supply a crafted payload containing malicious JavaScript within a page title field. This typically necessitates low-privileged or content-authoring access depending on the specific deployment permissions, or relies on social engineering and chained vulnerabilities if input vectors are exposed elsewhere.\nThe attack flow proceeds as follows: First, the attacker creates or updates a page title to include a malicious payload, such as a script tag or an event handler (e.g., <script>alert(document.domain)</script>). Second, the Silverstripe CMS backend stores this unescaped string within the database. Third, a targeted user, such as an administrator, navigates to the page list view within the CMS interface. Fourth, the application generates the breadcrumb trail, outputting the raw page title containing the malicious payload directly into the HTML response. Finally, the victim's browser parses the response and executes the embedded JavaScript within the security context of the administrative session.\nBecause the execution context is the browser of a user viewing the page list view, the payload inherits the privileges of that session. Depending on the victim's role, post-exploitation impact may include the execution of arbitrary administrative actions, creation of new backdoor accounts, modification of system configurations, or exfiltration of sensitive session tokens."
}