GHSA-m5q3-mvcr-gc5m

silverstripe/framework BackURL validation bypass with malformed URLs

7.5 HighFix available

GHSA-m5q3-mvcr-gc5m is a high vulnerability (CVSS 7.5) in silverstripe/framework, published May 27, 2024. No source lists public exploit code. Fixed in silverstripe/framework 4.0.4.

What does this mean?

Severity: 7.5 HighCVSS 3.1, GitHub Advisories
Exploit chance: UnscoredNo EPSS score yet
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 4.0.4silverstripe/framework +3 more

Description

A carefully constructed malformed URL can be used to circumvent the offsite redirection protection used on BackURL parameters. This could lead to users entering sensitive data in malicious websites instead of the intended one.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Affected packages

Affected packages
Package	Affected	Fixed
`silverstripe/framework` Packagist	4.0.0-rc1 up to 4.0.4	4.0.4
`silverstripe/framework` Packagist	4.1.0-rc1 up to 4.1.1	4.1.1
`silverstripe/framework` Packagist	4.0.0-rc1 up to 4.0.4, plus listed versions 4.0.04.0.0-rc24.0.0-rc34.0.14.0.1-rc14.0.24.0.3	4.0.4
`silverstripe/framework` Packagist	4.1.0-rc1 up to 4.1.1, plus listed versions 4.1.04.1.0-rc2	4.1.1

What each source reports

GitHub Advisories Score used7.5

silverstripe/framework BackURL validation bypass with malformed URLs

Record: GHSA-m5q3-mvcr-gc5m
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-601
Updated: 2026-11-02

OSV7.5