Description

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage() in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CAST_HTML and inserts $restoredItem->Title, $restoredItem->URLSegment, $restoredItem->CMSEditLink(), and $changedProperty['value'] without applying Convert::raw2xml(). When an administrator restores an archived page containing a crafted title or URL segment, the generated restoration message can execute stored JavaScript in the administrator's browser, compromising the confidentiality and integrity of the CMS session. This issue is fixed in version 3.2.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-28T23:17:07.357Z",
  "pubdate": "2026-08-28T23:17:07.357Z",
  "executiveSummary": "A Stored Cross-Site Scripting (XSS) vulnerability exists within the Silverstripe Versioned module prior to version 3.2.1.\nThe vulnerability resides in the RestoreAction::getRestoreMessage() function, which improperly handles user-controllable data during the restoration of archived pages.\nBy crafting malicious input for page titles, URL segments, or property values, an attacker can inject arbitrary JavaScript that executes within the browser context of an administrative user.\nThis flaw compromises the confidentiality and integrity of the CMS session, potentially allowing unauthorized administrative actions or data exfiltration.\nSuccessful exploitation requires the attacker to have the ability to modify or inject content that will later be processed by the ArchiveAdmin restore mechanism, typically requiring access to the CMS or a mechanism to influence object properties.",
  "technicalDetails": "The root cause of this vulnerability is the improper sanitization of output rendered as CAST_HTML within the RestoreAction::getRestoreMessage() method located in src/RestoreAction.php.\nWhen an archived record is restored, the system generates a notification message for the administrator. The application retrieves metadata from the restored object, specifically $restoredItem->Title, $restoredItem->URLSegment, $restoredItem->CMSEditLink(), and $changedProperty['value'].\nIn versions prior to 3.2.1, these fields are concatenated into the restoration message without utilizing the Convert::raw2xml() function or equivalent HTML-encoding methods. Because this data is interpreted as CAST_HTML, the browser renders any HTML tags or script blocks present in these fields.\nThe attack flow proceeds as follows: 1) An attacker with the ability to create or edit page content injects a malicious payload (e.g., <script>alert(document.cookie)</script>) into a page title or URL segment. 2) The page is subsequently archived by the system. 3) A privileged administrator accesses the ArchiveAdmin interface to restore the archived record. 4) The RestoreAction::getRestoreMessage() function processes the archived record, extracts the malicious payload, and includes it in the generated success notification. 5) When the administrator's browser renders the restoration message, the injected JavaScript executes under the context of the administrator’s authenticated session.\nThis vulnerability is classified as Stored XSS because the payload persists within the database associated with the archived version of the page until the restoration action is triggered. The impact is significant as it facilitates the hijacking of administrative sessions, the execution of unintended administrative commands, or the extraction of sensitive CMS information. Since the rendering occurs in the ArchiveAdmin, the vulnerability primarily targets administrative users with sufficient privileges to manage archived content. The exposure is limited to the CMS backend environment, but the security implications for the integrity of the Silverstripe installation are severe due to the elevated privileges of the target audience."
}