Description

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user with permission to configure a UserForms email recipient can use the subject field to run arbitrary code on the server, compromising confidentiality, integrity, and availability. This issue is fixed in versions 6.4.9, 7.0.7, and 7.1.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-27T20:17:49.973Z",
  "pubdate": "2026-08-27T20:17:49.973Z",
  "executiveSummary": "Silverstripe UserForms is susceptible to a Remote Code Execution (RCE) vulnerability resulting from improper input validation within the CMS email recipient configuration.\nThe vulnerability allows an authenticated CMS user with specific configuration permissions to inject malicious payloads into the email subject field.\nWhen processed by the server, these payloads are interpreted as executable code, leading to total system compromise.\nThe impact includes the loss of confidentiality, integrity, and availability, as an attacker gains the ability to execute arbitrary server-side commands.\nThis vulnerability affects versions 6.0.0 through 6.4.9, 7.0.7, and 7.1.1. Exploitation is contingent upon the attacker possessing the necessary permissions to modify email recipient settings within the Silverstripe CMS interface.",
  "technicalDetails": "The vulnerability resides in the handling of the email recipient subject field within the Silverstripe UserForms module. The root cause is a failure to properly sanitize or validate user-supplied input before it is passed to an internal evaluation or template rendering engine.\nIn the Silverstripe CMS, the UserForms module allows administrators to define email notifications that are triggered upon form submission. The 'Subject' field for these email notifications is insufficiently protected against injection attacks. Because the underlying architecture treats the content of this field as executable code or a templating string, an attacker can supply a crafted payload designed to escape the intended data context and reach the server-side execution environment.\nThe exploitation flow proceeds as follows: First, an authenticated user with permission to access the UserForms configuration navigates to the email recipient settings within the CMS. Second, the user inputs a malicious payload into the 'Subject' field. Third, upon saving or triggering the email notification process, the application processes the subject field using a vulnerable server-side function. Fourth, the injected payload is evaluated as code by the PHP interpreter. This grants the attacker the ability to execute system commands, access files, or manipulate the database, effectively compromising the hosting environment.\nThe affected versions include 6.0.0 to 6.4.9, 7.0.7, and 7.1.1. The attack is restricted to authenticated users who already hold administrative or configuration privileges over UserForms. While this mitigates the risk from unauthenticated external threats, it poses a severe risk from malicious or compromised internal accounts. Once the code is executed, the attacker inherits the privileges of the web server process, allowing for lateral movement, data exfiltration, or persistence mechanisms on the underlying server architecture.\nThis vulnerability constitutes a critical security flaw because it bypasses standard input security controls, transforming a configuration feature into a vector for arbitrary code execution."
}