CVE-2025-25197 Silverstripe Elemental enables XSS attacks in elemental "Content blocks in use" reports
Attackers can inject malicious scripts into Silverstripe Elemental content blocks, leading to XSS execution when viewing specific reports.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-25197?
CVE-2025-25197 is a medium-severity cross-site scripting vulnerability in silverstripe-elemental, published on 10 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Silverstripe Elemental extends a page type to swap the content area for a list of manageable elements to compose a page out of rather than a single text field. An elemental block can include an XSS payload, which can be executed when viewing the "Content blocks in use" report. The vulnerability is specific to that report and is a result of failure to cast input prior to including it in the grid field. This vulnerability is fixed in 5.3.12.
Weakness: CWE-79
Which versions are affected by CVE-2025-25197?
2 open source packages ship an affected version, including dnadesign/silverstripe-elemental.
| Package | Affected | Fixed in |
|---|---|---|
dnadesign/silverstripe-elemental Packagist | From 2.1.2 | 5.3.12 |
dnadesign/silverstripe-elemental Packagist | From 2.1.2 | 5.3.12 |
How do I fix CVE-2025-25197?
Upgrade dnadesign/silverstripe-elemental to 5.3.12 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-25197 being exploited?
There is no known exploitation of CVE-2025-25197 in the wild and no public exploit code.
Sources
Also known as GHSA-x8xm-c7p8-2pj2.