GHSA-39mm-rwm3-29jp

Source

https://github.com/advisories/GHSA-39mm-rwm3-29jp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-39mm-rwm3-29jp/GHSA-39mm-rwm3-29jp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-39mm-rwm3-29jp

Aliases

CVE-2026-54718

Published

2026-08-27T17:20:40Z

Modified

2026-09-11T05:15:04Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email template

Details

Impact

The advanced workflow email template field is vulnerable to a specially crafted payload that can be used to run arbitrary code on the server.

Reported by

Steve Boyd Silverstripe Ltd.

Database specific

{
    "cwe_ids":  [
        "CWE-1336",
        "CWE-20"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-27T17:20:40Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

Packagist

symbiote/silverstripe-advancedworkflow

Package

Name: symbiote/silverstripe-advancedworkflow
Purl: pkg:composer/symbiote/silverstripe-advancedworkflow

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.4.5

Affected versions

2.*

2.1.0

3.*

3.0.1-rc1

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.1.0

3.1.1

3.1.2

3.1.3

3.2.0

3.2.1

3.2.2

3.2.3

3.3.0

3.3.1

3.3.2

3.3.3

3.4.0

3.5.0

3.6.0

3.6.1

3.7.0

3.7.1

3.7.2

3.8.0

3.8.1

3.8.2

3.9.0

3.9.1

4.*

4.0.0

4.0.1

4.1.0

4.2.0

5.*

5.0.0

5.0.1

5.0.2

5.0.3

5.0.4

5.0.5

5.0.6

5.0.7

5.0.8

5.1.0

5.1.1

5.1.2

5.2.0

5.2.1

5.2.2

5.3.0

5.3.1

5.4.0-beta1

5.4.0-rc1

5.4.0

5.5.0-alpha1

5.5.0-beta1

5.5.0-rc1

5.5.0

5.5.1

5.6.0-beta1

5.6.0-rc1

5.6.0

5.7.0

5.8.0-beta1

5.8.0-rc1

5.8.0

5.9.0-beta1

5.9.0-rc1

5.9.0

5.9.1

5.9.2

5.9.3

5.9.4

5.9.5

5.9.6

5.9.7

6.*

6.0.0-beta1

6.0.0-rc1

6.0.0

6.0.1

6.0.2

6.0.3

6.0.4

6.1.0-beta1

6.1.0-rc1

6.1.0

6.1.1

6.1.2

6.1.3

6.1.4

6.2.0-beta1

6.2.0-rc1

6.2.0

6.2.1

6.2.2

6.2.3

6.2.4

6.3.0-beta1

6.3.0-rc1

6.3.0

6.3.1

6.4.0-beta1

6.4.0-rc1

6.4.0

6.4.1

6.4.2

6.4.3

6.4.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-39mm-rwm3-29jp/GHSA-39mm-rwm3-29jp.json"

symbiote/silverstripe-advancedworkflow

Package

Name: symbiote/silverstripe-advancedworkflow
Purl: pkg:composer/symbiote/silverstripe-advancedworkflow

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.0.0

Fixed

7.1.3

Affected versions

7.*

7.0.0

7.0.1

7.0.2

7.1.0-beta1

7.1.0-rc1

7.1.0

7.1.1

7.1.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-39mm-rwm3-29jp/GHSA-39mm-rwm3-29jp.json"

symbiote/silverstripe-advancedworkflow

Package

Name: symbiote/silverstripe-advancedworkflow
Purl: pkg:composer/symbiote/silverstripe-advancedworkflow

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.2.0

Fixed

7.2.1

Affected versions

7.*

7.2.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-39mm-rwm3-29jp/GHSA-39mm-rwm3-29jp.json"