CVE-2026-55779: Silverstripe Versioned XSS Vulnerability

CVE-2026-55779 Overview

CVE-2026-55779 is a stored cross-site scripting (XSS) vulnerability in the Silverstripe Versioned module, which provides versioning for Silverstripe models. The flaw exists in RestoreAction::getRestoreMessage() inside src/RestoreAction.php. The function builds ArchiveAdmin restore notifications rendered as CAST_HTML but inserts $restoredItem->Title, $restoredItem->URLSegment, $restoredItem->CMSEditLink(), and $changedProperty['value'] without applying Convert::raw2xml(). When an administrator restores an archived page containing a crafted title or URL segment, the restoration message executes attacker-controlled JavaScript in the administrator's browser. The issue is resolved in version 3.2.1.

Critical Impact
Successful exploitation executes stored JavaScript in an authenticated administrator's browser, compromising CMS session confidentiality and integrity.

Affected Products

Silverstripe Versioned module prior to 3.2.1
Silverstripe CMS installations using ArchiveAdmin restore workflows
Any Silverstripe deployment where lower-privileged users can create or edit page titles and URL segments

Discovery Timeline

2026-08-28 - CVE-2026-55779 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-55779

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw [CWE-79] in the ArchiveAdmin restore workflow. RestoreAction::getRestoreMessage() builds an HTML message that reports the outcome of a page restoration. Because the message is rendered with the CAST_HTML casting type, any user-controlled fields interpolated into the string are treated as HTML markup rather than plain text.

The fields Title, URLSegment, and the return value of CMSEditLink() are user-influenced. When an attacker with content-editing privileges stores JavaScript in a page title or URL segment, the payload persists with the archived record. When an administrator later restores that archived page, the notification renders the payload in the authenticated CMS session.

Root Cause

The root cause is missing output encoding. The vulnerable code path assigns user-supplied values directly into an HTML-cast template without calling Convert::raw2xml(). The $changedProperty['value'] array element is also interpolated a second time as a {value} placeholder, so escaping is required in both locations. User interaction is required, which is why the CVSS vector includes UI:R.

Attack Vector

A lower-privileged content editor creates or modifies a page and injects a JavaScript payload into the Title or URLSegment field. The page is then archived. When an administrator uses ArchiveAdmin to restore the archived record, getRestoreMessage() renders the payload as active HTML, executing script in the administrator's context. Attackers can pivot from a content-editor role to full CMS session compromise, including CSRF-backed actions.

php

// Security patch in src/RestoreAction.php
public static function getRestoreMessage($originalItem, $restoredItem, $changedLocation = false)
{
    // The message is rendered as HTML (CAST_HTML), so any user-supplied content
    // (e.g. Title, URLSegment) must be escaped to prevent stored XSS.
    $restoredID = Convert::raw2xml($restoredItem->Title ?: $restoredItem->ID);
    $restoredType = Convert::raw2xml(strtolower($restoredItem->i18n_singular_name() ?? ''));

    $editLink = $restoredItem->CMSEditLink();
    if ($editLink) {
        $restoredID = sprintf('<a href="%s">%s</a>', Convert::raw2xml($editLink), $restoredID);
    }

    // These values are interpolated into the message a second time (as "{value}"), so
    // they must be escaped here as well as in $restoredID above.
    if ($originalItem->URLSegment !== $restoredItem->URLSegment) {
        $changedProperty = [
            'property' => 'URL',
            'value' => Convert::raw2xml('../' . $restoredItem->URLSegment)
        ];
    } elseif ($originalItem->Title !== $restoredItem->Title) {
        $changedProperty = [
            'property' => 'Name',
            'value' => Convert::raw2xml($restoredItem->Title)
        ];
    }
}

Source: GitHub Commit 6e30a2cf

Detection Methods for CVE-2026-55779

Indicators of Compromise

Page records or archived versions with Title or URLSegment values containing HTML tags such as <script>, <img onerror=, or <svg onload=.
Unexpected outbound HTTP requests originating from administrator browser sessions immediately after ArchiveAdmin restore operations.
New privileged CMS accounts, role changes, or content modifications performed by administrator accounts without corresponding manual actions.

Detection Strategies

Query the SiteTree, SiteTree_Versions, and related versioned tables for records whose Title or URLSegment columns contain <, >, javascript:, or event-handler substrings.
Review Silverstripe audit logs and web server access logs for restore actions in ArchiveAdmin (admin/archive) that immediately precede anomalous admin activity.
Monitor Content Security Policy (CSP) violation reports for inline script executions occurring in CMS admin routes.

Monitoring Recommendations

Alert on any administrator session that performs restore actions followed by user or role management API calls within a short window.
Track version history diffs for large or HTML-containing changes to Title and URLSegment fields authored by non-administrator accounts.
Ingest CMS access and application logs into a centralized analytics platform to correlate content-editor activity with administrator restore events.

How to Mitigate CVE-2026-55779

Immediate Actions Required

Upgrade the silverstripe/versioned package to version 3.2.1 or later on all Silverstripe CMS installations.
Audit archived pages for suspicious HTML or JavaScript payloads in Title and URLSegment before performing any restore operations.
Rotate active CMS administrator sessions and reset credentials if restore actions were performed against untrusted archived content.

Patch Information

The fix is included in Silverstripe Versioned 3.2.1. The patch applies Convert::raw2xml() to Title, URLSegment, and CMSEditLink() values before they are interpolated into the HTML-cast restore message. See the GitHub Pull Request #541 and the GitHub Security Advisory GHSA-m4g4-86qc-v8w7 for details. Additional vendor guidance is available at the Silverstripe CVE-2026-55779 Release page.

Workarounds

Restrict ArchiveAdmin restore permissions to a minimal set of trusted administrators until the upgrade is applied.
Enforce a strict Content Security Policy on CMS admin routes that disallows inline scripts and unsafe event handlers.
Validate and reject HTML metacharacters in Title and URLSegment inputs at the application layer for user roles that do not require them.

bash

# Upgrade the Silverstripe Versioned module to the patched release
composer require silverstripe/versioned:^3.2.1
composer update silverstripe/versioned
vendor/bin/sake dev/build flush=1