AIKIDO-2026-820857
silverstripe/versioned is vulnerable to Cross-Site Scripting (XSS)
54
Medium Risk
This Affects:
silverstripe/versionedTL;DR
The silverstripe/versioned module builds a restore confirmation message in RestoreAction::getRestoreMessage that is shown in the archive admin. Before the fix, the restored record's title, edit link, and changed URL segment were interpolated into this message without escaping, and the message is rendered as HTML. An attacker who controls a record's title or URL segment can inject markup that executes in an administrator's browser when the record is restored, leading to stored cross-site scripting. The fix escapes these values with Convert::raw2xml so they are treated as inert text.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and an attacker can influence the title or URL segment of a record that an administrator restores in the archive admin.
Background info
silverstripe/versioned is vulnerable to Cross-Site Scripting (XSS) in versions 1.0.0 - 3.2.0.
How to fix this
Upgrade the silverstripe/versioned library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant