GHSA-52cw-pvq9-9m5v
Silverstripe uses TinyMCE which allows svg files linked in object tags
Impact
TinyMCE v6 has a configuration value convert_unsafe_embeds set to false which allows svg files containing javascript to be used in <object> or <embed> tags, which can be used as a vector for XSS attacks.
Note that <embed> tags are not allowed by default.
After patching the default value of convert_unsafe_embeds will be set to true. This means that <object> tags will be converted to iframes instead the next time the page is saved, which may break any pages that rely upon previously saved <object> tags. Developers can override this configuration if desired to revert to the original behaviour.
We reviewed the potential impact of this vulnerability within the context of Silverstripe CMS. We concluded this is a medium impact vulnerability given how TinyMCE is used by Silverstripe CMS.
References:
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score used
Silverstripe uses TinyMCE which allows svg files linked in object tags
Impact
TinyMCE v6 has a configuration value convert_unsafe_embeds set to false which allows svg files containing javascript to be used in <object> or <embed> tags, which can be used as a vector for XSS attacks.
Note that <embed> tags are not allowed by default.
After patching the default value of convert_unsafe_embeds will be set to true. This means that <object> tags will be converted to iframes instead the next time the page is saved, which may break any pages that rely upon previously saved <object> tags. Developers can override this configuration if desired to revert to the original behaviour.
We reviewed the potential impact of this vulnerability within the context of Silverstripe CMS. We concluded this is a medium impact vulnerability given how TinyMCE is used by Silverstripe CMS.
References:
- Record
GHSA-52cw-pvq9-9m5v- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-79, CWE-1395
- Updated
- 2026-11-02
OSV
Silverstripe uses TinyMCE which allows svg files linked in object tags
Impact
TinyMCE v6 has a configuration value convert_unsafe_embeds set to false which allows svg files containing javascript to be used in <object> or <embed> tags, which can be used as a vector for XSS attacks.
Note that <embed> tags are not allowed by default.
After patching the default value of convert_unsafe_embeds will be set to true. This means that <object> tags will be converted to iframes instead the next time the page is saved, which may break any pages that rely upon previously saved <object> tags. Developers can override this configuration if desired to revert to the original behaviour.
We reviewed the potential impact of this vulnerability within the context of Silverstripe CMS. We concluded this is a medium impact vulnerability given how TinyMCE is used by Silverstripe CMS.
References:
- Record
GHSA-52cw-pvq9-9m5v- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-1395, CWE-79
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
silverstripe/frameworkPackagist | before 5.2.16 | 5.2.16 |
silverstripe/frameworkPackagist | before 5.2.16, plus listed versions 2.4.102.4.112.4.122.4.132.4.9 Show 45 moreShow less2.5.03.0.103.0.10-rc13.0.113.0.11-rc13.0.123.0.133.0.143.0.2.13.0.33.0.3-rc13.0.3-rc23.0.43.0.53.0.63.0.6-rc13.0.6-rc23.0.73.0.7-rc13.0.83.0.93.0.9-rc13.1.03.1.0-beta13.1.0-beta23.1.0-beta33.1.0-rc13.1.0-rc23.1.0-rc33.1.13.1.103.1.10-rc13.1.10-rc23.1.113.1.11-rc13.1.123.1.133.1.13-rc13.1.143.1.14-rc13.1.153.1.163.1.16-rc13.1.173.1.17-rc1 | 5.2.16 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-52cw-pvq9-9m5v is a medium vulnerability (CVSS 5.3) in silverstripe/framework, published July 17, 2024. No source lists public exploit code. Fixed in silverstripe/framework 5.2.16.
References
github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-52cw-pvq9-9m5v
silverstripe.org/download/security-releases/ss-2024-001
Left out here: 375 versions. The JSON record has them.