CVE-2026-54721
Silverstripe UserForms: Remote code execution via userforms email subject
Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user with permission to configure a UserForms email recipient can use the subject field to run arbitrary code on the server, compromising confidentiality, integrity, and availability. This issue is fixed in versions 6.4.9, 7.0.7, and 7.1.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Silverstripe UserForms: Remote code execution via userforms email subject
Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user with permission to configure a UserForms email recipient can use the subject field to run arbitrary code on the server, compromising confidentiality, integrity, and availability. This issue is fixed in versions 6.4.9, 7.0.7, and 7.1.1.
- Record
CVE-2026-54721- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2026-67239
Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user with permission to configure a UserForms email recipient can use the subject field to run arbitrary code on the server, compromising confidentiality, integrity, and availability. This issue is fixed in versions 6.4.9, 7.0.7, and 7.1.1.
- Record
EUVD-2026-67239- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-g8wr-r2v2-vqc6
silverstripe/userforms vulnerable to remote code execution via userforms email subject
Impact
The userform email subject field in the CMS is vulnerable to a specially crafted payload being used to run arbitrary code on the server.
Reported by
Jack Wallace from Bastion Security
- Record
GHSA-g8wr-r2v2-vqc6- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-94
- Updated
- 2026-11-02
NVD
Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user with permission to configure a UserForms email recipient can use the subject field to run arbitrary code on the server, compromising confidentiality, integrity, and availability. This issue is fixed in versions 6.4.9, 7.0.7, and 7.1.1.
- Record
CVE-2026-54721- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
Silverstripe UserForms: Remote code execution via userforms email subject
Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user with permission to configure a UserForms email recipient can use the subject field to run arbitrary code on the server, compromising confidentiality, integrity, and availability. This issue is fixed in versions 6.4.9, 7.0.7, and 7.1.1.
- Record
CVE-2026-54721- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-g8wr-r2v2-vqc6
silverstripe/userforms vulnerable to remote code execution via userforms email subject
Impact
The userform email subject field in the CMS is vulnerable to a specially crafted payload being used to run arbitrary code on the server.
Reported by
Jack Wallace from Bastion Security
- Record
GHSA-g8wr-r2v2-vqc6- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-94
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
silverstripe/userformsPackagist |
before 6.4.9 | 6.4.9 |
silverstripe/userformsPackagist |
7.0.0 up to 7.0.7 | 7.0.7 |
silverstripe/userformsPackagist |
7.1.0 up to 7.1.1 | 7.1.1 |
silverstripe/userformsPackagist |
before 6.4.9, plus listed versions 0.5.11.0.11.1.0-beta2.0.12.0.1-rc1 Show 45 moreShow less2.0.102.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.93.0.03.0.0-beta13.0.13.0.23.1.03.1.13.1.24.0.04.0.14.1.04.2.04.2.14.2.24.2.34.2.44.2.54.2.64.3.04.3.14.3.24.3.34.3.44.3.54.4.04.4.14.4.24.5.04.5.14.5.24.5.34.5.44.5.54.5.64.5.74.5.84.6.0 |
6.4.9 |
silverstripe/userformsPackagist |
7.0.0 up to 7.0.7, plus listed versions 7.0.17.0.27.0.37.0.47.0.57.0.6 |
7.0.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-54721 is a high vulnerability (CVSS 8.8) in Silverstripe Silverstripe-userforms, published August 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. Fixed in silverstripe/userforms 6.4.9.
References
github.com/silverstripe/silverstripe-userforms/security/advisories/GHSA-g8wr-r2v2-vqc6
Show 8 moreShow less
silverstripe.org/download/security-releases/cve-2026-54721
nvd.nist.gov/vuln/detail/CVE-2026-54721
Left out here: 122 versions. The JSON record has them.