CVE-2026-55779 Silverstripe Versioned: XSS in archive admin restore
An attacker can execute stored JavaScript in an administrator's browser by restoring an archived page with a crafted title, compromising the CMS session.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-55779?
CVE-2026-55779 is a medium-severity cross-site scripting vulnerability in silverstripe-versioned, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage() in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CAST_HTML and inserts $restoredItem->Title, $restoredItem->URLSegment, $restoredItem->CMSEditLink(), and $changedProperty['value'] without applying Convert::raw2xml(). When an administrator restores an archived page containing a crafted title or URL segment, the generated restoration message can execute stored JavaScript in the administrator's browser, compromising the confidentiality and integrity of the CMS session. This issue is fixed in version 3.2.1.
Weakness: CWE-79
Which versions are affected by CVE-2026-55779?
2 open source packages ship an affected version, including silverstripe/versioned.
| Package | Affected | Fixed in |
|---|---|---|
silverstripe/versioned Packagist | All versions | 3.2.1 |
silverstripe/versioned Packagist | All versions | 3.2.1 |
How do I fix CVE-2026-55779?
Upgrade silverstripe/versioned to 3.2.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-55779 being exploited?
There is no known exploitation of CVE-2026-55779 in the wild and no public exploit code.
Sources
Also known as GHSA-m4g4-86qc-v8w7.