silverstripe/framework allows upload of dangerous file types
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Code execution
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-434.
Summary
Some potentially dangerous file types exist in File.allowed_extensions which could allow a malicious CMS user to upload files that then get executed in the security context of the website. We have removed the ability to upload .css, .js, .potm, .dotm, .xltm and .jar files in the default configuration. Since allowed_extensions are synced to webserver configuration (in assets/.htaccess) automatically, this will also deny access to any existing uploads with these extensions. Review our security guidelines for the Common Web Platform and the File Security guide for SilverStripe 4 to find out how to add or remove extensions.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | silverstripe/framework (Packagist) | 3.6.5-rc1 to before 3.6.6 | 3.6.6 | Patch available | GHSA-vcg6-8fxc-x5cq |
| — | silverstripe/framework (Packagist) | 4.0.3-rc1 to before 4.0.4 | 4.0.4 | Patch available | GHSA-vcg6-8fxc-x5cq |
| — | silverstripe/framework (Packagist) | 4.1.0-rc1 to before 4.1.1 | 4.1.1 | Patch available | GHSA-vcg6-8fxc-x5cq |
- silverstripe/framework (Packagist) Vendor— Affected 3.6.5-rc1 to before 3.6.6 Fixed in 3.6.6 Patch available GHSA-vcg6-8fxc-x5cq
- silverstripe/framework (Packagist) Vendor— Affected 4.0.3-rc1 to before 4.0.4 Fixed in 4.0.4 Patch available GHSA-vcg6-8fxc-x5cq
- silverstripe/framework (Packagist) Vendor— Affected 4.1.0-rc1 to before 4.1.1 Fixed in 4.1.1 Patch available GHSA-vcg6-8fxc-x5cq
Remediation
- Fix · GHSA-vcg6-8fxc-x5cq silverstripe/framework (Packagist) Fixed in 3.6.6 Advisory →
- Fix · GHSA-vcg6-8fxc-x5cq silverstripe/framework (Packagist) Fixed in 4.0.4 Advisory →
- Fix · GHSA-vcg6-8fxc-x5cq silverstripe/framework (Packagist) Fixed in 4.1.1 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-vcg6-8fxc-x5cq
References
Other 4
- https://github.com/silverstripe/silverstripe-framework/commit/0408048653fafc52e02b4dbc6288e14e634ac613
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2018-014-1.yaml
- https://github.com/silverstripe/silverstripe-framework
- https://www.silverstripe.org/download/security-releases/ss-2018-014
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences