GHSA-qp29-wcc2-vmpc
Silverstripe HtmlEditor embed url sanitisation
"Add from URL" doesn't clearly sanitise URL server side
HtmlEditorField_Toolbar has an action HtmlEditorField_Toolbar#viewfile, which gets called by the CMS when adding a media "from a URL" (i.e. via oembed).
This action gets the URL to add in the GET parameter FileURL. However it doesn't do any URL sanitising server side. The current logic will pass this through to Oembed, which will probably reject most dangerous URLs, but it's possible future changes would break this.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score used
Silverstripe HtmlEditor embed url sanitisation
"Add from URL" doesn't clearly sanitise URL server side
HtmlEditorField_Toolbar has an action HtmlEditorField_Toolbar#viewfile, which gets called by the CMS when adding a media "from a URL" (i.e. via oembed).
This action gets the URL to add in the GET parameter FileURL. However it doesn't do any URL sanitising server side. The current logic will pass this through to Oembed, which will probably reject most dangerous URLs, but it's possible future changes would break this.
- Record
GHSA-qp29-wcc2-vmpc- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSV
Silverstripe HtmlEditor embed url sanitisation
"Add from URL" doesn't clearly sanitise URL server side
HtmlEditorField_Toolbar has an action HtmlEditorField_Toolbar#viewfile, which gets called by the CMS when adding a media "from a URL" (i.e. via oembed).
This action gets the URL to add in the GET parameter FileURL. However it doesn't do any URL sanitising server side. The current logic will pass this through to Oembed, which will probably reject most dangerous URLs, but it's possible future changes would break this.
- Record
GHSA-qp29-wcc2-vmpc- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
silverstripe/frameworkPackagist | 3.0.0 up to 3.2.1 | 3.2.1 |
silverstripe/frameworkPackagist | 3.0.0 up to 3.2.1, plus listed versions 3.0.103.0.10-rc13.0.113.0.11-rc13.0.12 Show 45 moreShow less3.0.133.0.143.0.2.13.0.33.0.3-rc13.0.3-rc23.0.43.0.53.0.63.0.6-rc13.0.6-rc23.0.73.0.7-rc13.0.83.0.93.0.9-rc13.1.03.1.0-beta13.1.0-beta23.1.0-beta33.1.0-rc13.1.0-rc23.1.0-rc33.1.13.1.103.1.10-rc13.1.10-rc23.1.113.1.11-rc13.1.123.1.133.1.13-rc13.1.143.1.14-rc13.1.153.1.163.1.16-rc13.1.173.1.17-rc13.1.17-rc23.1.183.1.18-rc13.1.18-rc23.1.193.1.19-rc1 | 3.2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-qp29-wcc2-vmpc is a medium vulnerability (CVSS 4.3) in silverstripe/framework, published May 23, 2024. No source lists public exploit code. Fixed in silverstripe/framework 3.2.1.
References
Left out here: 29 versions. The JSON record has them.