GHSA-p2v5-xcqm-4fv6

silverstripe/taxonomy SQL Injection vulnerability

7.5 HighFix available

There is a vulnerability in silverstripe/taxonomy module that allows SQL injection. This affected controller (TaxonomyDirectoryController) is disabled by default and must be enabled by a developer for the exploit to be possible.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

What each source reports

GitHub Advisories Score used7.5

silverstripe/taxonomy SQL Injection vulnerability

Record: GHSA-p2v5-xcqm-4fv6
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

OSV7.5

silverstripe/taxonomy SQL Injection vulnerability

Record: GHSA-p2v5-xcqm-4fv6
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`silverstripe/taxonomy` Packagist	1.3.0 up to 1.3.1	1.3.1
`silverstripe/taxonomy` Packagist	2.0.0 up to 2.0.1	2.0.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-p2v5-xcqm-4fv6 is a high vulnerability (CVSS 7.5) in silverstripe/taxonomy, published May 28, 2024. No source lists public exploit code. Fixed in silverstripe/taxonomy 1.3.1.