CVE-2026-54721

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54721
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54721.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54721
Aliases
Published
2026-08-27T16:52:46Z
Modified
2026-10-28T02:30:22Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Silverstripe UserForms: Remote code execution via userforms email subject
Details

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user with permission to configure a UserForms email recipient can use the subject field to run arbitrary code on the server, compromising confidentiality, integrity, and availability. This issue is fixed in versions 6.4.9, 7.0.7, and 7.1.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54721.json"
}
References

Affected packages

Git / github.com/silverstripe/silverstripe-userforms

Affected ranges

Type
GIT
Repo
https://github.com/silverstripe/silverstripe-userforms
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c55494ad7c717b199a3c1663b43a54db5d95604c
Introduced
982819c09734e2d58a931cab1e9d869012ddc016
Fixed
23c069866900c19b499bfa997d1e251e97491702
Introduced
4418856b97c398bfe54b4f4f93e100cc7997d06b
Fixed
c371b6953d2b2ee8fdf2a3a771701c583b9b8333
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "6.4.9"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "7.0.0"
                },
                {
                    "fixed": "7.0.7"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "7.1.0"
                },
                {
                    "fixed": "7.1.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "23c069866900c19b499bfa997d1e251e97491702"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "c55494ad7c717b199a3c1663b43a54db5d95604c"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "6.4.9",
            "range": [
                {
                    "fixed": "c55494ad7c717b199a3c1663b43a54db5d95604c"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "7.0.7",
            "range": [
                {
                    "fixed": "23c069866900c19b499bfa997d1e251e97491702"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "7.1.1",
            "range": [
                {
                    "fixed": "c371b6953d2b2ee8fdf2a3a771701c583b9b8333"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*
0.4
1.*
1.1.0-beta
2.*
2.0.1
2.0.1-rc1
2.0.10
2.0.2
2.0.3
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.*
3.0.0
3.0.0-beta1
3.0.1
3.0.2
3.1.0
3.1.1
4.*
4.0.0
4.0.1
4.1.0
5.*
5.0.0-beta1
5.0.0-beta2
5.1.0
5.10.0-alpha1
5.11.0
5.12.0
5.7.0
5.9.0-beta1
5.9.1
5.9.2
6.*
6.0.0-beta1
6.1.0-beta1
6.2.0-beta1
6.2.0-rc1
6.3.0-beta1
6.3.0-rc1
6.4.0
6.4.0-beta1
6.4.0-rc1
6.4.1
6.4.2
6.4.3
6.4.4
6.4.5
6.4.6
6.4.7
6.4.8
7.*
7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.1.0
7.1.0-rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54721.json"