GHSA-265q-222x-52m6

silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector

8.8 HighFix available

A potential SQL injection vulnerability was identified by using the silverstripe/postgresql database adapter. While unlikely to be exploitable, we have patched silverstripe/framework to ensure that table names are safely escaped before being passed to database adapters or user code.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

What each source reports

GitHub Advisories Score used8.8

silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector

Record: GHSA-265q-222x-52m6
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

OSV8.8

silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector

Record: GHSA-265q-222x-52m6
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`silverstripe/framework` Packagist	4.0.0-rc1 up to 4.0.6	4.0.6
`silverstripe/framework` Packagist	4.1.0-rc1 up to 4.1.4	4.1.4
`silverstripe/framework` Packagist	4.2.0-rc1 up to 4.2.3	4.2.3
`silverstripe/framework` Packagist	4.0.0-rc1 up to 4.0.6, plus listed versions 4.0.04.0.0-rc24.0.0-rc34.0.14.0.1-rc1 Show 4 moreShow less 4.0.24.0.34.0.44.0.5	4.0.6
`silverstripe/framework` Packagist	4.1.0-rc1 up to 4.1.4, plus listed versions 4.1.04.1.0-rc24.1.14.1.24.1.3	4.1.4
`silverstripe/framework` Packagist	4.2.0-rc1 up to 4.2.3, plus listed versions 4.2.04.2.14.2.2	4.2.3

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-265q-222x-52m6 is a high vulnerability (CVSS 8.8) in silverstripe/framework, published May 28, 2024. No source lists public exploit code. Fixed in silverstripe/framework 4.0.6.