GHSA-g5vj-wj9x-4jg9
symbiote/silverstripe-multivaluefield Possible PHP Object Injection via Multi-Value Field Extension
GHSA-g5vj-wj9x-4jg9 is a medium vulnerability (CVSS 6.1) in symbiote/silverstripe-multivaluefield, published May 29, 2024. No source lists public exploit code. Fixed in symbiote/silverstripe-multivaluefield 3.1.0.
- Severity
- 6.1 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.1.0symbiote/silverstripe-multivaluefield +1 more
Description
A potential deserialisation vulnerability has been identified in the symbiote/silverstripe-multivaluefield which could allow an attacker to exploit implementations of this module via object injection.
Support for handling PHP objects as values in this module has been deprecated, and the serialisation technique has been switched to using JSON for handling arrays.
As well as this, a potential XSS (cross-site scripting) vulnerability has been identified and remediated.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
symbiote/silverstripe-multivaluefieldPackagist | 3.0.0 up to 3.1.0 | 3.1.0 |
symbiote/silverstripe-multivaluefieldPackagist | 3.0.0 up to 3.1.0, plus listed versions 3.0.13.0.23.0.33.0.43.0.5 | 3.1.0 |
What each source reports
GitHub Advisories Score used
symbiote/silverstripe-multivaluefield Possible PHP Object Injection via Multi-Value Field Extension
A potential deserialisation vulnerability has been identified in the symbiote/silverstripe-multivaluefield which could allow an attacker to exploit implementations of this module via object injection.
Support for handling PHP objects as values in this module has been deprecated, and the serialisation technique has been switched to using JSON for handling arrays.
As well as this, a potential XSS (cross-site scripting) vulnerability has been identified and remediated.
- Record
GHSA-g5vj-wj9x-4jg9- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-74, CWE-79
- Updated
- 2026-11-02
OSV
symbiote/silverstripe-multivaluefield Possible PHP Object Injection via Multi-Value Field Extension
A potential deserialisation vulnerability has been identified in the symbiote/silverstripe-multivaluefield which could allow an attacker to exploit implementations of this module via object injection.
Support for handling PHP objects as values in this module has been deprecated, and the serialisation technique has been switched to using JSON for handling arrays.
As well as this, a potential XSS (cross-site scripting) vulnerability has been identified and remediated.
- Record
GHSA-g5vj-wj9x-4jg9- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-74, CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/symbiote/silverstripe-multivaluefield/commit/31fbc8c208431fc7d7e96da6fa39ca057d978953
silverstripe.org/download/security-releases/ss-2018-017