Read the docs
TI-2024-38793 Aliases GHSA-g5vj-wj9x-4jg9

symbiote/silverstripe-multivaluefield Possible PHP Object Injection via Multi-Value Field Extension

Priority LOW 38CWE-74Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Cross-site scripting
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-79.

Summary

A potential deserialisation vulnerability has been identified in the symbiote/silverstripe-multivaluefield which could allow an attacker to exploit implementations of this module via object injection. Support for handling PHP objects as values in this module has been deprecated, and the serialisation technique has been switched to using JSON for handling arrays. As well as this, a potential XSS (cross-site scripting) vulnerability has been identified and remediated.

Why it matters now

Fix Fixed symbiote/silverstripe-multivaluefield (Packagist): 3.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—symbiote/silverstripe-multivaluefield (Packagist)3.0.0 to before 3.1.03.1.0Patch availableGHSA-g5vj-wj9x-4jg9
  • symbiote/silverstripe-multivaluefield (Packagist) Vendor— Affected 3.0.0 to before 3.1.0 Fixed in 3.1.0 Patch available GHSA-g5vj-wj9x-4jg9

Remediation

  • Fix · GHSA-g5vj-wj9x-4jg9 symbiote/silverstripe-multivaluefield (Packagist) Fixed in 3.1.0 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-g5vj-wj9x-4jg9

References

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences