CVE-2026-54717
Silverstripe: XSS in breadcrumbs in page list view
Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list view, because page titles are rendered into the breadcrumb trail without being escaped. This issue is fixed in 6.2.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Silverstripe: XSS in breadcrumbs in page list view
Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list view, because page titles are rendered into the breadcrumb trail without being escaped. This issue is fixed in 6.2.1.
- Record
CVE-2026-54717- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-54257
Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list view, because page titles are rendered into the breadcrumb trail without being escaped. This issue is fixed in 6.2.1.
- Record
EUVD-2026-54257- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w3cp-g2pf-65wh
Silverstripe: XSS in breadcrumbs in page list view
Impact
Page breadcrumbs in the CMS are vulnerable to XSS when viewed using the page list view
Reporter
Fase Rais Baradika
- Record
GHSA-w3cp-g2pf-65wh- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list view, because page titles are rendered into the breadcrumb trail without being escaped. This issue is fixed in 6.2.1.
- Record
CVE-2026-54717- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Silverstripe: XSS in breadcrumbs in page list view
Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list view, because page titles are rendered into the breadcrumb trail without being escaped. This issue is fixed in 6.2.1.
- Record
CVE-2026-54717- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-w3cp-g2pf-65wh
Silverstripe: XSS in breadcrumbs in page list view
Impact
Page breadcrumbs in the CMS are vulnerable to XSS when viewed using the page list view
Reporter
Fase Rais Baradika
- Record
GHSA-w3cp-g2pf-65wh- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
silverstripe/cmsPackagist |
before 6.2.1 | 6.2.1 |
silverstripe/cmsPackagist |
before 6.2.1, plus listed versions 2.4.102.4.112.4.122.4.132.4.9 Show 45 moreShow less2.5.03.0.103.0.10-rc13.0.113.0.11-rc13.0.123.0.133.0.143.0.2.13.0.33.0.3-rc13.0.3-rc23.0.43.0.53.0.63.0.6-rc13.0.6-rc23.0.73.0.7-rc13.0.83.0.93.0.9-rc13.1.03.1.0-beta13.1.0-beta23.1.0-beta33.1.0-rc13.1.0-rc23.1.0-rc33.1.13.1.103.1.10-rc13.1.10-rc23.1.113.1.11-rc13.1.123.1.133.1.13-rc13.1.143.1.14-rc13.1.153.1.163.1.16-rc13.1.173.1.17-rc1 |
6.2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-54717 is a medium vulnerability (CVSS 5.4) in Silverstripe Silverstripe-cms, published August 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in silverstripe/cms 6.2.1.
References
github.com/silverstripe/silverstripe-cms/security/advisories/GHSA-w3cp-g2pf-65wh
silverstripe.org/download/security-releases/cve-2026-54717
Left out here: 298 versions. The JSON record has them.