---
id: CVE-2026-54720
aliases:
  - GHSA-gvrw-qqp5-jgc5
title: 'Silverstripe Framework: Possible XSS attack through media embed'
summary: 'Silverstripe Framework: Possible XSS attack through media embed'
severity: medium
cvss: 5.4
cwe:
  - CWE-79
vendor: silverstripe
product: silverstripe/framework
ecosystem: composer
affected:
  - silverstripe/framework < 6.2.2
patched:
  - silverstripe/framework 6.2.2
published: '2026-08-27'
updated: '2026-08-27'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-gvrw-qqp5-jgc5'
references:
  - url: >-
      https://github.com/silverstripe/silverstripe-framework/security/advisories/GHSA-gvrw-qqp5-jgc5
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54720'
  - url: 'https://github.com/silverstripe/silverstripe-framework/pull/11993'
  - url: >-
      https://github.com/silverstripe/silverstripe-framework/commit/1bcb02adfc365c6436dc26ab2f6dd32d97f3979b
  - url: >-
      https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/CVE-2026-54720.yaml
  - url: 'https://github.com/silverstripe/silverstripe-framework/releases/tag/6.2.2'
  - url: 'https://www.silverstripe.org/download/security-releases/cve-2026-54720'
  - url: 'https://github.com/advisories/GHSA-gvrw-qqp5-jgc5'
tags:
  - ghsa
  - composer
epss: 0.00263
epssPercentile: 0.16151
ingestedAt: '2026-08-27T17:05:20.084Z'
---

## Overview

### Impact
The "Insert media from web" functionality in the CMS is vulnerable to XSS from a specially crafted embed.

### Reported by
Jack Wallace from Bastion Security

## Affected packages

- `silverstripe/framework < 6.2.2`

## Remediation

Upgrade to a patched release:

- `silverstripe/framework 6.2.2`