Silverstripe uses TinyMCE which allows svg files linked in object tags
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-79.
Summary
### Impact TinyMCE v6 has a configuration value `convert_unsafe_embeds` set to `false` which allows svg files containing javascript to be used in `<object>` or `<embed>` tags, which can be used as a vector for XSS attacks. Note that `<embed>` tags are not allowed by default. After patching the default value of `convert_unsafe_embeds` will be set to `true`. This means that `<object>` tags will be converted to iframes instead the next time the page is saved, which may break any pages that rely upon previously saved `<object>` tags. Developers can override this configuration if desired to revert to the original behaviour. We reviewed the potential impact of this vulnerability within the context of Silverstripe CMS. We concluded this is a medium impact vulnerability given how TinyMCE is used by Silverstripe CMS. ### References: - https://www.silverstripe.org/download/security-releases/ss-2024-001 - https://github.com/advisories/GHSA-5359-pvf2-pw78
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | silverstripe/framework (Packagist) | before 5.2.16 | 5.2.16 | Patch available | GHSA-52cw-pvq9-9m5v |
- silverstripe/framework (Packagist) Vendor— Affected before 5.2.16 Fixed in 5.2.16 Patch available GHSA-52cw-pvq9-9m5v
Remediation
- Fix · GHSA-52cw-pvq9-9m5v silverstripe/framework (Packagist) Fixed in 5.2.16 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-52cw-pvq9-9m5v
References
Other 4
- https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-52cw-pvq9-9m5v
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2024-001.yaml
- https://github.com/silverstripe/silverstripe-framework
- https://www.silverstripe.org/download/security-releases/ss-2024-001
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences