CVE-2026-55779: 
PHP vulnerability analysis and mitigation

CVE-2026-55779 is a stored Cross-Site Scripting (XSS) vulnerability in the silverstripe/versioned Composer package (Silverstripe Versioned) affecting all versions prior to 3.2.1. The flaw exists in RestoreAction::getRestoreMessage() within src/RestoreAction.php, where user-controlled fields (Title, URLSegment, CMSEditLink(), and changedProperty['value']) are inserted into an HTML-rendered restoration notification without applying Convert::raw2xml() encoding. It was discovered and disclosed on June 24, 2026, with the fix released the same day. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Feedly).

The root cause is improper output encoding (CWE-79) in the getRestoreMessage() method of RestoreAction.php. The method builds an ArchiveAdmin restore notification rendered as CAST_HTML but interpolates $restoredItem->Title, $restoredItem->URLSegment, $restoredItem->CMSEditLink(), and $changedProperty['value'] directly into the HTML string without escaping. An attacker who can create or modify a page with a crafted title or URL segment (e.g., <iframe src=javascript:alert(1)> or <button formaction="javascript:alert(1)">) can store a malicious payload that executes when an administrator restores the archived page in the CMS. The fix applies Convert::raw2xml() to all user-supplied values before interpolation (GitHub Commit, GitHub Advisory).

Successful exploitation allows stored JavaScript to execute in the browser of a CMS administrator who restores an archived page, compromising the confidentiality and integrity of the administrator's CMS session. An attacker could steal session cookies, perform unauthorized CMS actions (such as modifying content or creating admin accounts), or conduct further attacks against the CMS backend. Availability is not directly impacted, and the scope is limited to the CMS session of the triggering administrator (GitHub Advisory, Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires that an attacker be able to create or manipulate a page with a crafted title or URL segment prior to archival, and that a CMS administrator subsequently restores that page — making it a stored XSS with a required user interaction step (Feedly).

1. Craft a malicious page: As a user with page-creation or editing privileges (or via another injection vector), create or modify a Silverstripe CMS page and set its Title or URLSegment field to a JavaScript payload, e.g., <iframe src=javascript:alert(document.cookie)> or <button formaction="javascript:alert(1)">Click</button>.
2. Archive the page: Ensure the malicious page is archived (moved to the archive) so it appears in the ArchiveAdmin interface.
3. Wait for administrator action: Wait for a CMS administrator to navigate to the ArchiveAdmin section and initiate a restore of the archived page containing the crafted title or URL segment.
4. Trigger XSS execution: When the administrator restores the page, RestoreAction::getRestoreMessage() builds the notification message using the unescaped Title or URLSegment, and the message is rendered as HTML (CAST_HTML) in the administrator's browser, executing the injected JavaScript.
5. Achieve objective: The executed script can exfiltrate the administrator's session cookie, perform authenticated CMS actions on their behalf, or deliver further payloads (GitHub Commit, GitHub Advisory).

• Logs: CMS audit logs showing a page restore action performed by an administrator on a page with an unusual or HTML-encoded title or URL segment containing script tags, iframe elements, or event handler attributes.
• Network: Outbound requests from the administrator's browser to unexpected external domains immediately following a page restore action in the CMS (potential session cookie exfiltration).
• File System / CMS Content: Pages in the archive with Title or URLSegment fields containing HTML tags such as <script>, <iframe>, <button formaction=...>, or JavaScript URI schemes (javascript:).
• Process/Session: Unexpected CMS administrative actions (new admin user creation, content modification, settings changes) occurring shortly after a page restore event, potentially indicating session hijacking.

Upgrade silverstripe/versioned to version 3.2.1 or later, which applies Convert::raw2xml() to all user-supplied fields (Title, URLSegment, CMSEditLink(), and changedProperty['value']) before rendering the restore notification message (GitHub Release, GitHub Advisory). As interim mitigations, enforce a Content Security Policy (CSP) that disallows inline script execution in the CMS, and restrict page creation/editing privileges to trusted users only. Note that the fix has not been backported to the Silverstripe 5 (silverstripe-versioned v2) branch as of the disclosure date; Silverstripe 5 users should consult the official security release blog for guidance (Silverstripe Blog).

The vulnerability was reported by Steve Boyd of Silverstripe Ltd. and fixed by developer emteknetnz (GitHub Advisory). Community discussion on the fix pull request raised concerns that the patch was not backported to Silverstripe 5 (silverstripe-versioned v2), leaving non-EOL Silverstripe 5.4 installations without a direct fix. A community member (xini) criticized the project's security backport policy, arguing it leaves supported versions knowingly vulnerable and that the contribution process needs to be more open to address such issues promptly (GitHub PR #541). Silverstripe acknowledged the concern and published a security release blog post addressing the situation.