High severity8.8GHSA Advisory· Published Aug 27, 2026· Updated Sep 9, 2026
CVE-2026-54721
CVE-2026-54721
Description
Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user with permission to configure a UserForms email recipient can use the subject field to run arbitrary code on the server, compromising confidentiality, integrity, and availability. This issue is fixed in versions 6.4.9, 7.0.7, and 7.1.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
silverstripe/userformsPackagist | < 6.4.9 | 6.4.9 |
silverstripe/userformsPackagist | >= 7.0.0, < 7.0.7 | 7.0.7 |
silverstripe/userformsPackagist | >= 7.1.0, < 7.1.1 | 7.1.1 |
Affected products
2- Range: >= 7.1.0, < 7.1.1
Patches
Vulnerability mechanics
References
11- github.com/advisories/GHSA-g8wr-r2v2-vqc6ghsaADVISORY
- github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/userforms/CVE-2026-54721.yamlghsaWEB
- github.com/silverstripe/silverstripe-userforms/commit/23c069866900c19b499bfa997d1e251e97491702nvdWEB
- github.com/silverstripe/silverstripe-userforms/commit/c55494ad7c717b199a3c1663b43a54db5d95604cnvdWEB
- github.com/silverstripe/silverstripe-userforms/pull/1441nvdWEB
- github.com/silverstripe/silverstripe-userforms/pull/1442nvdWEB
- github.com/silverstripe/silverstripe-userforms/releases/tag/6.4.9nvdWEB
- github.com/silverstripe/silverstripe-userforms/releases/tag/7.0.7nvdWEB
- github.com/silverstripe/silverstripe-userforms/releases/tag/7.1.1nvdWEB
- github.com/silverstripe/silverstripe-userforms/security/advisories/GHSA-g8wr-r2v2-vqc6nvdWEB
- www.silverstripe.org/download/security-releases/cve-2026-54721ghsaWEB
News mentions
0No linked articles in our index yet.