CVE-2026-54721: 
PHP vulnerability analysis and mitigation

CVE-2026-54721 is a remote code execution (RCE) vulnerability in the Silverstripe UserForms module (silverstripe/userforms) for Silverstripe CMS. The vulnerability exists in the email recipient subject field of the CMS visual form builder, which fails to properly sanitize input, allowing a specially crafted payload to be evaluated as server-side PHP code. Affected versions include all releases before 6.4.9, 7.0.0–7.0.6, and 7.1.0. The vulnerability was reported by Jack Wallace from Bastion Security, first disclosed on June 24, 2026, and published to the GitHub Advisory Database on August 27, 2026. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory).

The root cause is improper input validation (CWE-20) combined with improper control of code generation (CWE-94). The EmailSubject field of a UserForms email recipient is rendered as a Silverstripe template at form submission time. Because the template engine evaluates the subject string without sanitizing author-controlled content, an attacker can embed a Silverstripe template tag (e.g., <%t Foo "{${\'file_put_contents\'(...)}}"%>) that causes PHP code to be executed server-side via the <%t %> default string handling mechanism. Exploitation requires the attacker to be an authenticated CMS user with permission to configure UserForms email recipients. The fix adds a dependency on silverstripe/template-engine ^1.0.1 (for the 6.x branch) and bumps silverstripe/framework to ^5.4.30 (for the 7.x branch) to prevent PHP evaluation within author-controlled template strings (GitHub Advisory, Patch Commit 23c0698, Patch Commit c55494a).

Successful exploitation allows an authenticated CMS user to execute arbitrary PHP code on the server with the privileges of the web application process, resulting in high impact to confidentiality, integrity, and availability. An attacker could read sensitive data (e.g., database credentials, environment variables), modify or delete application files, deploy web shells for persistent access, or pivot to other systems accessible from the server. The scope is limited to the affected server, but the ability to write arbitrary files or execute system commands makes lateral movement and full system compromise realistic outcomes (GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The vulnerability requires low privileges (authenticated CMS access with UserForms configuration permissions), no user interaction, and low attack complexity over the network. No threat actor attribution has been reported, and the CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is not yet published for this CVE.

1. Gain CMS Access: Obtain credentials for a Silverstripe CMS account with permission to configure UserForms email recipients (e.g., through phishing, credential stuffing, or insider access).
2. Navigate to UserForms Email Recipient Settings: In the CMS, open a UserForm page, navigate to the "Recipients" tab, and open or create an email recipient configuration.
3. Craft Malicious Subject Payload: In the "Email Subject" field, enter a specially crafted Silverstripe template payload that embeds PHP code, such as:

   <%t Foo "{${\'file_put_contents\'(\'/path/to/webroot/shell.php\',\'<?php system($_GET[cmd]); ?>\')}}"%>

4. Save the Recipient Configuration: Save the form recipient settings, persisting the malicious subject to the database.
5. Trigger Form Submission: Submit the UserForm (e.g., as an anonymous visitor or via a crafted HTTP POST request), which causes the CMS to render the EmailSubject as a template, evaluating the embedded PHP payload server-side.
6. Achieve Code Execution: The PHP function (e.g., file_put_contents) executes with the web server process privileges, writing a web shell or performing other malicious actions on the server (GitHub Advisory, Patch Commit 23c0698).

• Logs: CMS audit logs showing modification of a UserForms email recipient's subject field to a value containing <%t, {${, or PHP function names (e.g., file_put_contents, system, exec, passthru); web server access logs showing POST requests to UserForm submission endpoints followed by unexpected file creation or outbound connections.
• File System: Unexpected PHP files (web shells) created in the web root or asset directories (e.g., files with .php extension in /assets/ or application directories); presence of a file named userforms_rce_test.txt in the assets path (used in the PoC test case).
• Process: Unusual child processes spawned by the PHP-FPM or web server process (e.g., bash, sh, curl, wget, python) following a UserForm submission.
• Database: UserForms EmailRecipient records with EmailSubject values containing Silverstripe template syntax (<%t ... %>) combined with PHP variable interpolation patterns ({${...}}).

Silverstripe has released patched versions: 6.4.9, 7.0.7, and 7.1.1. Administrators should upgrade the silverstripe/userforms Composer package to one of these versions immediately. As a compensating control where immediate patching is not possible, restrict CMS access and UserForms email recipient configuration permissions to only fully trusted administrators, and audit existing email recipient subject fields for suspicious template syntax. Monitor CMS access logs for unauthorized modifications to UserForms recipient settings (GitHub Advisory, Silverstripe Security Release).

The vulnerability was reported by Jack Wallace from Bastion Security and patched by the Silverstripe core team (emteknetnz) on June 24, 2026, with the advisory published publicly on August 27, 2026. No significant broader media coverage or notable public researcher commentary beyond the official advisory and patch commits has been identified at this time (GitHub Advisory).