CVE-2026-54717

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54717", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-15T23:07:33.231Z", "datePublished": "2026-08-06T20:27:17.974Z", "dateUpdated": "2026-08-07T14:32:58.836Z"}, "containers": {"cna": {"title": "Silverstripe: XSS in breadcrumbs in page list view", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/silverstripe/silverstripe-cms/security/advisories/GHSA-w3cp-g2pf-65wh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/silverstripe/silverstripe-cms/security/advisories/GHSA-w3cp-g2pf-65wh"}, {"name": "https://github.com/silverstripe/silverstripe-cms/pull/3175", "tags": ["x_refsource_MISC"], "url": "https://github.com/silverstripe/silverstripe-cms/pull/3175"}, {"name": "https://github.com/silverstripe/silverstripe-cms/commit/62f9912baa18c80304f3fa8b6eca71bb5dc2d21e", "tags": ["x_refsource_MISC"], "url": "https://github.com/silverstripe/silverstripe-cms/commit/62f9912baa18c80304f3fa8b6eca71bb5dc2d21e"}, {"name": "https://github.com/silverstripe/silverstripe-cms/releases/tag/6.2.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/silverstripe/silverstripe-cms/releases/tag/6.2.1"}], "affected": [{"vendor": "silverstripe", "product": "silverstripe-cms", "versions": [{"version": "< 6.2.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T20:27:17.974Z"}, "descriptions": [{"lang": "en", "value": "Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list view, because page titles are rendered into the breadcrumb trail without being escaped. This issue is fixed in 6.2.1."}], "source": {"advisory": "GHSA-w3cp-g2pf-65wh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-07T14:32:51.176180Z", "id": "CVE-2026-54717", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T14:32:58.836Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54717", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T14:32:51.176180Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T14:32:54.451Z"}}], "cna": {"title": "Silverstripe: XSS in breadcrumbs in page list view", "source": {"advisory": "GHSA-w3cp-g2pf-65wh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "silverstripe", "product": "silverstripe-cms", "versions": [{"status": "affected", "version": "< 6.2.1"}]}], "references": [{"url": "https://github.com/silverstripe/silverstripe-cms/security/advisories/GHSA-w3cp-g2pf-65wh", "name": "https://github.com/silverstripe/silverstripe-cms/security/advisories/GHSA-w3cp-g2pf-65wh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/silverstripe/silverstripe-cms/pull/3175", "name": "https://github.com/silverstripe/silverstripe-cms/pull/3175", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/silverstripe/silverstripe-cms/commit/62f9912baa18c80304f3fa8b6eca71bb5dc2d21e", "name": "https://github.com/silverstripe/silverstripe-cms/commit/62f9912baa18c80304f3fa8b6eca71bb5dc2d21e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/silverstripe/silverstripe-cms/releases/tag/6.2.1", "name": "https://github.com/silverstripe/silverstripe-cms/releases/tag/6.2.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list view, because page titles are rendered into the breadcrumb trail without being escaped. This issue is fixed in 6.2.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T20:27:17.974Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54717", "state": "PUBLISHED", "dateUpdated": "2026-08-07T14:32:58.836Z", "dateReserved": "2026-06-15T23:07:33.231Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-06T20:27:17.974Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "silverstripe-cms", "vendor": "silverstripe", "versions": [{"status": "affected", "version": "< 6.2.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list view, because page titles are rendered into the breadcrumb trail without being escaped. This issue is fixed in 6.2.1."}, {"lang": "es", "value": "Silverstripe CMS es un sistema de gesti\u00f3n de contenidos de c\u00f3digo abierto. Anteriormente a la 6.2.1, las migas de pan de las p\u00e1ginas en el CMS son vulnerables a cross-site scripting cuando se visualizan utilizando la vista de lista de p\u00e1ginas, porque los t\u00edtulos de las p\u00e1ginas se renderizan en el rastro de migas de pan sin ser escapados. Este problema se ha solucionado en la 6.2.1."}], "id": "CVE-2026-54717", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54717", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-07T14:32:51.176180Z", "version": "2.0.3"}}]}, "published": "2026-08-06T22:17:44.543", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/silverstripe/silverstripe-cms/commit/62f9912baa18c80304f3fa8b6eca71bb5dc2d21e"}, {"source": "security-advisories@github.com", "url": "https://github.com/silverstripe/silverstripe-cms/pull/3175"}, {"source": "security-advisories@github.com", "url": "https://github.com/silverstripe/silverstripe-cms/releases/tag/6.2.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/silverstripe/silverstripe-cms/security/advisories/GHSA-w3cp-g2pf-65wh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.2.1)"}}], "enrichment": {"confidence": 93.0, "confidence_source": "matching", "scores": [{"score": 93.0, "source": "matching"}]}, "original": {"product": "silverstripe-cms", "source": "cna", "vendor": "silverstripe"}, "product": "silverstripe", "vendor": "silverstripe"}], "created": "2026-08-07T00:30:06.736962+00:00", "updated": "2026-08-07T09:00:05.225577+00:00", "vendors": ["silverstripe", "silverstripe$PRODUCT$silverstripe"]}