https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T18:11:59.923523+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-55779 fkie_cve-2026-55779 2026-09-30T18:11:59.946602+00:00

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage() in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CAST_HTML and inserts $restoredItem->Title, $restoredItem->URLSegment, $restoredItem->CMSEditLink(), and $changedProperty['value'] without applying Convert::raw2xml(). When an administrator restores an archived page containing a crafted title or URL segment, the generated restoration message can execute stored JavaScript in the administrator's browser, compromising the confidentiality and integrity of the CMS session. This issue is fixed in version 3.2.1.

 https://vulnerability.circl.lu/vuln/ghsa-m4g4-86qc-v8w7 GHSA-m4g4-86qc-v8w7 — silverstripe/versioned has XSS in archive admin restore 2026-09-30T18:11:59.946718+00:00

Affected: Packagist: silverstripe/versioned

### Impact It's possible to use the page title as an XSS vector when restoring a page in ArchiveAdmin

### Reporter Steve Boyd Silverstripe Ltd.