Silverstripe XSS in Director::force_redirect()
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-79.
Summary
A low level XSS vulnerability has been found in the Framework affecting http redirection via the Director::force_redirect method. Attempts to redirect to a url may generate HTML which is not safely escaped, and may pose a risk of XSS in some environments. This vulnerability is marked low as it is difficult to exploit, as any injected HTML will only be returned from the server if the Location HTTP header is also sent, meaning that any user browsing the site would not be exposed to the body of the response before their browser redirects them.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | silverstripe/framework (Packagist) | 3.1.0 to before 3.1.12 | 3.1.12 | Patch available | GHSA-jqp8-v74p-g8px |
- silverstripe/framework (Packagist) Vendor— Affected 3.1.0 to before 3.1.12 Fixed in 3.1.12 Patch available GHSA-jqp8-v74p-g8px
Remediation
- Fix · GHSA-jqp8-v74p-g8px silverstripe/framework (Packagist) Fixed in 3.1.12 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-jqp8-v74p-g8px
References
Other 4
- https://github.com/silverstripe/silverstripe-framework/commit/ee9bddb808df6d27db4d56bb5d522dcfe6788715
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2015-010-1.yaml
- https://github.com/silverstripe/silverstripe-framework
- https://www.silverstripe.org/software/download/security-releases/ss-2015-010-xss-in-directorforce-redirect
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences