CVE-2026-55779: Silverstripe Versioned: XSS in archive admin restore
Impact It's possible to use the page title as an XSS vector when restoring a page in ArchiveAdmin
Reporter Steve Boyd Silverstripe Ltd.
Other sources
Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage() in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem->Title, $restoredItem->URLSegment, $restoredItem->CMSEditLink(), and $changedProperty['value'] without applying Convert::raw2xml(). When an administrator restores an archived page containing a crafted title or URL segment, the generated restoration message can execute stored JavaScript in the administrator's browser, compromising the confidentiality and integrity of the CMS session. This issue is fixed in version 3.2.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/silverstripe/versionedto a version that resolves this vulnerability.Fixed in 3.2.1 - Upgrade
Upgrade
Silverstripe Versionedto a version that resolves this vulnerability.Fixed in 3.2.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Administrators who restore archived pages in ArchiveAdmin are exposed if the archived page has a crafted title or URL segment. Successful exploitation can run stored JavaScript in the administrator's browser and affect the confidentiality and integrity of their CMS session.
What does an attacker need to exploit it?
An attacker needs a crafted page title or URL segment to be present in an archived page and must induce an administrator to restore that page through ArchiveAdmin. The vulnerability has network access, low attack complexity, no required privileges, and requires user interaction.
Which versions are affected and how is it fixed?
Silverstripe Versioned versions prior to 3.2.1 are affected. Upgrade to version 3.2.1, which fixes the unsafe handling of values in ArchiveAdmin restoration notifications.