CVE-2025-30148 Silverstripe Framework has a XSS vulnerability in HTML editor

Medium 5.4 Published 10 Apr 2025 Updated 10 Apr 2025

An attacker with CMS edit access can inject JavaScript via crafted payloads bypassing server-side sanitization, leading to potential code execution on the front end.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-30148?

CVE-2025-30148 is a medium-severity cross-site scripting vulnerability in silverstripe-framework, published on 10 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. Prior to 5.3.23, bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitized on the client-side, but server-side sanitization doesn't catch it. The server-side sanitization logic has been updated to sanitize against this attack. This vulnerability is fixed in 5.3.23.

Weakness: CWE-79

Which versions are affected by CVE-2025-30148?

2 open source packages ship an affected version, including silverstripe/framework. It affects 1 product.

Package	Affected	Fixed in
`silverstripe/framework` Packagist	All versions	`5.3.23`
`silverstripe/framework` Packagist	All versions	`5.3.23`

Products include Silverstripe Framework.

How do I fix CVE-2025-30148?

Upgrade silverstripe/framework to 5.3.23 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-30148 being exploited?

There is no known exploitation of CVE-2025-30148 in the wild and no public exploit code.

Sources

Also known as GHSA-rhx4-hvx9-j387.