{"id":"CVE-2026-54721","title":"Silverstripe UserForms provides a visual form builder for the Silverstripe CMS","summary":"Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted a…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-94","CWE-20"],"vendor":"silverstripe","product":"silverstripe/userforms","affected":["silverstripe/userforms < 6.4.9","silverstripe/userforms >= 7.0.0, < 7.0.7","silverstripe/userforms >= 7.1.0, < 7.1.1"],"patched":["silverstripe/userforms 6.4.9","silverstripe/userforms 7.0.7","silverstripe/userforms 7.1.1"],"published":"2026-08-27","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54721","references":[{"url":"https://github.com/silverstripe/silverstripe-userforms/commit/23c069866900c19b499bfa997d1e251e97491702","label":"security-advisories@github.com"},{"url":"https://github.com/silverstripe/silverstripe-userforms/commit/c55494ad7c717b199a3c1663b43a54db5d95604c","label":"security-advisories@github.com"},{"url":"https://github.com/silverstripe/silverstripe-userforms/pull/1441","label":"security-advisories@github.com"},{"url":"https://github.com/silverstripe/silverstripe-userforms/pull/1442","label":"security-advisories@github.com"},{"url":"https://github.com/silverstripe/silverstripe-userforms/releases/tag/6.4.9","label":"security-advisories@github.com"},{"url":"https://github.com/silverstripe/silverstripe-userforms/releases/tag/7.0.7","label":"security-advisories@github.com"},{"url":"https://github.com/silverstripe/silverstripe-userforms/releases/tag/7.1.1","label":"security-advisories@github.com"},{"url":"https://github.com/silverstripe/silverstripe-userforms/security/advisories/GHSA-g8wr-r2v2-vqc6","label":"security-advisories@github.com"},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/userforms/CVE-2026-54721.yaml"},{"url":"https://www.silverstripe.org/download/security-releases/cve-2026-54721"},{"url":"https://github.com/advisories/GHSA-g8wr-r2v2-vqc6"}],"tags":["nvd","ghsa","composer"],"epss":0.00733,"epssPercentile":0.52414,"aliases":["GHSA-g8wr-r2v2-vqc6"],"ecosystem":"composer","ingestedAt":"2026-08-27T17:05:19.997Z","slug":"CVE-2026-54721","body":"## Overview\n\nSilverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user with permission to configure a UserForms email recipient can use the subject field to run arbitrary code on the server, compromising confidentiality, integrity, and availability. This issue is fixed in versions 6.4.9, 7.0.7, and 7.1.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-54721)\n\nAffected packages:\n\n- `silverstripe/userforms < 6.4.9`\n- `silverstripe/userforms >= 7.0.0, < 7.0.7`\n- `silverstripe/userforms >= 7.1.0, < 7.1.1`\n\nPatched in:\n\n- `silverstripe/userforms 6.4.9`\n- `silverstripe/userforms 7.0.7`\n- `silverstripe/userforms 7.1.1`\n\nSource: https://github.com/advisories/GHSA-g8wr-r2v2-vqc6","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}