PHP package security
Is silverstripe/framework vulnerable?
103 known security advisories for silverstripe/framework. The latest was reported on 2026-10-28 and is fixed in 6.2.13. The newest release, 6.3.2, is not affected by any of them.
3 critical 13 high 69 medium 8 low 10 unscored
- Known advisories
- 103
- Newest release
- 6.3.2
- Released
- 2026-11-02
- Affecting newest release
- 0
- Last synced
- 2026-11-03
Check your version
Security advisories for silverstripe/framework
| Reported | Advisory | Severity | Affected | Fixed in |
|---|---|---|---|---|
| 2026-10-28 | CVE-2026-88988 - XSS via SVG data URI CVE-2026-88988 · FriendsOfPHP/security-advisories | unscored | <6.2.13 | 6.2.13 |
| 2026-10-28 | SS-2026-004 - Password reset token account takeover Advisory · FriendsOfPHP/security-advisories | unscored | <6.2.13 | 6.2.13 |
| 2026-10-28 | CVE-2026-91112 - CMS_ACCESS_SecurityAdmin privilege escalation CVE-2026-91112 · FriendsOfPHP/security-advisories | unscored | <6.2.13 | 6.2.13 |
| 2026-10-28 | CVE-2026-91110 - XSS using control bytes CVE-2026-91110 · FriendsOfPHP/security-advisories | unscored | <6.2.13 | 6.2.13 |
| 2026-10-28 | CVE-2026-88989 - Auth bypass GridFieldDetailForm CVE-2026-88989 · FriendsOfPHP/security-advisories | unscored | <6.2.13 | 6.2.13 |
| 2026-10-28 | CVE-2026-91115 - RCE via i18nTextCollectorTask writer parameter CVE-2026-91115 · FriendsOfPHP/security-advisories | unscored | >=6.0.0,<6.2.13 | 6.2.13 |
| 2026-10-28 | CVE-2026-88987 - XSS via XHTML data URI CVE-2026-88987 · FriendsOfPHP/security-advisories | unscored | <6.2.13 | 6.2.13 |
| 2026-10-28 | CVE-2026-91114 - Stored XSS via unescaped permission in PermissionCheckboxSetField CVE-2026-91114 · FriendsOfPHP/security-advisories | unscored | <6.2.13 | 6.2.13 |
| 2026-10-28 | CVE-2026-91113 - User-controlled ClassName allows unauthorized record type change CVE-2026-91113 · FriendsOfPHP/security-advisories | unscored | <6.2.13 | 6.2.13 |
| 2026-06-24 | CVE-2026-54720 - XSS attack through media embed CVE-2026-54720 · GitHub, FriendsOfPHP/security-advisories | medium | <6.2.2 | 6.2.2 |
| 2025-04-10 | CVE-2025-30148 - XSS vulnerability in HTML editor CVE-2025-30148 · GitHub, FriendsOfPHP/security-advisories | medium | <5.3.23 | 5.3.23 |
| 2025-04-10 | SS-2025-001 - User enumeration via timing attack Advisory · GitHub, FriendsOfPHP/security-advisories | medium | <5.3.23 | 5.3.23 |
| 2025-01-14 | CVE-2024-53277 - XSS in form messages CVE-2024-53277 · GitHub, FriendsOfPHP/security-advisories | medium | <5.3.8 | 5.3.8 |
| 2025-01-14 | CVE-2024-47605 - XSS via insert media remote file oembed CVE-2024-47605 · GitHub, FriendsOfPHP/security-advisories | medium | <5.3.8 | 5.3.8 |
| 2025-01-14 | SS-2024-002 - Reflected Cross Site Scripting (XSS) in error message Advisory · GitHub, FriendsOfPHP/security-advisories | low | <5.3.8 | 5.3.8 |
| 2024-07-17 | CVE-2024-32981 - XSS Vulnerability with text/html base64-encoded payload CVE-2024-32981 · GitHub, FriendsOfPHP/security-advisories | medium | <5.2.16 | 5.2.16 |
| 2024-07-17 | SS-2024-001 - TinyMCE allows svg files linked in object tags Advisory · GitHub, FriendsOfPHP/security-advisories | low | <5.2.16 | 5.2.16 |
| 2024-01-22 | CVE-2023-48714 Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter CVE-2023-48714 · GitHub, FriendsOfPHP/security-advisories | medium | >=3.0.0,<4.0.0 | >=4.0.0,<4.13.39 | >=5.0.0,<5.1.11 | 4.0.0, 4.13.39, 5.1.11 |
| 2023-07-30 | CVE-2023-32302 - Members with no password can be created and bypass custom login forms CVE-2023-32302 · GitHub, FriendsOfPHP/security-advisories | low | >=3.0.0,<4.13.14 | >=5.0.0,<5.0.13 | 4.13.14, 5.0.13 |
| 2023-04-25 | CVE-2023-22729 - Open redirect vulnerability on CMSSecurity relogin screen CVE-2023-22729 · GitHub, FriendsOfPHP/security-advisories | medium | >=4.0.0,<4.12.5 | 4.12.5 |
| 2023-04-25 | CVE-2023-22728 - Missing permission check in GridFieldPrintButton CVE-2023-22728 · GitHub, FriendsOfPHP/security-advisories | medium | >=4.0.0,<4.12.5 | 4.12.5 |
| 2022-06-27 | CVE-2022-25238: Stored XSS via HTML fields CVE-2022-25238 · GitHub, FriendsOfPHP/security-advisories | medium | >=4.0.0,<4.10.9 | 4.10.9 |
| 2022-06-27 | CVE-2022-28803: Stored XSS in link tags added via XHR CVE-2022-28803 · GitHub, FriendsOfPHP/security-advisories | medium | >=4.0.0,<4.10.9 | 4.10.9 |
| 2022-06-27 | CVE-2021-41559: Quadratic blowup in Convert::xml2array() CVE-2021-41559 · GitHub, FriendsOfPHP/security-advisories | medium | >=4.0.0,<4.10.9 | 4.10.9 |
| 2022-05-24 | SilverStripe XXE Vulnerability in CSSContentParser GHSA-3vjc-5x79-m9r8 · CVE-2020-25817 · GitHub | medium | >=4.0.0,<4.7.4 | 4.7.4 |
| 2022-05-24 | SilverStripe Folders migrated from 3.x may be unsafe to upload to GHSA-592m-4533-rxq9 · CVE-2020-9280 · GitHub | high | >=4.0.0,<4.4.6 | 4.4.6 |
| 2022-05-17 | Silverstripe XSS Vulnerabilities GHSA-v358-rvxr-wffx · CVE-2012-4968 · GitHub | medium | >=2.4,<2.4.7 | >=2.3,<2.3.13 | 2.3.13, 2.4.7 |
| 2022-05-14 | SilverStripe CSV Excel Macro Injection GHSA-2jvj-mhf2-g99w · CVE-2017-18049 · GitHub | medium | >=4.0.0,<4.0.1 | >=3.6.0,<3.6.3 | <3.5.6 | 3.5.6, 3.6.3, 4.0.1 |
| 2022-05-14 | Silverstripe CMS Open Redirect GHSA-fh35-p8ph-p545 · CVE-2015-5062 · GitHub | medium | <=3.1.13 | not stated |
| 2022-05-14 | SilverStripe vulnerable to Cross-site Scripting GHSA-wg4m-vvp6-2hc5 · CVE-2010-1593 · GitHub | low | <2.3.5 | 2.3.5 |
| 2022-02-06 | Business Logic Errors in SilverStripe Framework GHSA-32m2-9f76-4gv8 · CVE-2022-0227 · GitHub | medium | <4.10.1 | 4.10.1 |
| 2021-11-21 | CVE-2022-38462 - Reflected XSS in querystring parameters CVE-2022-38462 · GitHub, FriendsOfPHP/security-advisories | medium | >=4.0.0,<4.11.13 | 4.11.13 |
| 2021-11-21 | CVE-2022-37430 - Stored XSS using uppercase characters in HTMLEditor CVE-2022-37430 · GitHub, FriendsOfPHP/security-advisories | medium | >=4.0.0,<4.11.13 | 4.11.13 |
| 2021-11-21 | CVE-2022-38724 - XSS in shortcodes CVE-2022-38724 · GitHub, FriendsOfPHP/security-advisories | medium | >=4.0.0,<4.11.13 | 4.11.13 |
| 2021-11-21 | CVE-2022-37429 - Stored XSS using HTMLEditor CVE-2022-37429 · GitHub, FriendsOfPHP/security-advisories | medium | >=4.0.0,<4.11.13 | 4.11.13 |
| 2021-11-21 | CVE-2022-38148 - Blind SQL Injection via GridFieldSortableHeader CVE-2022-38148 · GitHub, FriendsOfPHP/security-advisories | high | >=4.0.0,<4.10.11 | >=4.11.0,<4.11.14 | 4.10.11, 4.11.14 |
| 2021-06-07 | CVE-2020-26138 FormField: with square brackets in field name skips validation CVE-2020-26138 · GitHub, FriendsOfPHP/security-advisories | medium | >=3.0.0,<4.0.0 | >=4.0.0,<4.7.4 | 4.0.0, 4.7.4 |
| 2021-06-07 | CVE-2021-25817 XXE: Vulnerability in CSSContentParser CVE-2021-25817 · FriendsOfPHP/security-advisories | unscored | >=4.0.0,<4.7.4 | 4.7.4 |
| 2020-07-14 | CVE-2020-9311: Malicious user profile information can cause login form XSS CVE-2020-9311 · GitHub, FriendsOfPHP/security-advisories | medium | >=3.0.0,<3.7.5 | 3.7.5 |
| 2020-07-10 | CVE-2020-6164: Information disclosure on /interactive URL path CVE-2020-6164 · GitHub, FriendsOfPHP/security-advisories | high | >=4.0.0,<4.4.7 | >=4.5.0,<4.5.4 | 4.4.7, 4.5.4 |
| 2020-07-10 | CVE-2019-19326: Web Cache Poisoning through HTTPRequestBuilder CVE-2019-19326 · GitHub, FriendsOfPHP/security-advisories | medium | >=4.0.0,<4.4.7 | >=4.5.0,<4.5.4 | >=3.0.0,<3.7.5 | 3.7.5, 4.4.7, 4.5.4 |
| 2020-02-16 | CVE-2019-19325: XSS through non-scalar FormField attributes CVE-2019-19325 · GitHub, FriendsOfPHP/security-advisories | medium | >=4.0.0,<4.4.5 | >=4.5.0,<4.5.2 | 4.4.5, 4.5.2 |
| 2019-11-12 | Lack of access control on upoaded files GHSA-jvx5-rm6q-gx7p · CVE-2019-12245 · GitHub | medium | >=4.4.0,<4.4.4 | >=4.0.0,<4.3.6 | >=3.7.0,<3.7.4 | <3.6.8 | 3.6.8, 3.7.4, 4.3.6, 4.4.4 |
| 2019-09-24 | CVE-2019-16409: Secureassets and versionedfiles modules can expose versions of protected files CVE-2019-16409 · GitHub, FriendsOfPHP/security-advisories | medium | >=4.0.0,<4.3.5 | >=4.4.0,<4.4.4 | 4.3.5, 4.4.4 |
| 2019-09-24 | CVE-2019-14272: XSS in file titles managed through the CMS CVE-2019-14272 · GitHub, FriendsOfPHP/security-advisories | medium | >=4.0.0,<4.3.5 | >=4.4.0,<4.4.4 | 4.3.5, 4.4.4 |
| 2019-09-24 | CVE-2019-14273: Broken Access control on files CVE-2019-14273 · GitHub, FriendsOfPHP/security-advisories | medium | >=4.0.0,<4.3.5 | >=4.4.0,<4.4.4 | 4.3.5, 4.4.4 |
| 2019-09-24 | CVE-2019-12205: Clipboard Reflected XSS CVE-2019-12205 · GitHub, FriendsOfPHP/security-advisories | medium | >=3.0.0,<3.9.99 | >=4.3.0,<4.3.5 | >=4.4.0,<4.4.4 | 3.9.99, 4.3.5, 4.4.4 |
| 2019-09-24 | CVE-2019-12204: Missing warning on install.php on public webroot can lead to unauthenticated admin access CVE-2019-12204 · GitHub, FriendsOfPHP/security-advisories | critical | >=4.1.0,<4.3.5 | >=4.4.0,<4.4.4 | 4.3.5, 4.4.4 |
| 2019-09-24 | CVE-2019-12617: Access escalation for CMS users with limited access through permission cache pollution CVE-2019-12617 · GitHub, FriendsOfPHP/security-advisories | low | >=4.3.0,<4.3.5 | >=4.4.0,<4.4.4 | 4.3.5, 4.4.4 |
| 2019-09-24 | CVE-2019-12203: Session fixation in "change password" form CVE-2019-12203 · GitHub, FriendsOfPHP/security-advisories | medium | >=3.6.0,<3.6.8 | >=3.7.0,<3.7.4 | >=4.0.0,<4.3.5 | >=4.4.0,<4.4.4 | 3.6.8, 3.7.4, 4.3.5, 4.4.4 |
| 2019-06-11 | CVE-2019-12246: Denial of Service on flush and development URL tools CVE-2019-12246 · GitHub, FriendsOfPHP/security-advisories | medium | >=4.0.0,<4.4.0 | >=4.1.0,<4.4.0 | >=4.2.0,<4.4.0 | >=4.3.0,<4.4.0 | 4.4.0 |
| 2019-02-19 | CVE-2019-5715: Reflected SQL Injection through Form and DataObject CVE-2019-5715 · GitHub, FriendsOfPHP/security-advisories | critical | >=3.0.0,<3.6.7 | >=3.7.0,<3.7.3 | >=4.0.0,<4.0.7 | >=4.1.0,<4.1.5 | >=4.2.0,<4.2.4 | >=4.3.0,<4.3.1 | 3.6.7, 3.7.3, 4.0.7, 4.1.5, 4.2.4, 4.3.1 |
| 2018-12-12 | SS-2018-019: Possible denial of service attack vector when flushing Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=4.0.0,<4.0.5 | >=4.1.0,<4.1.3 | >=4.2.0,<4.2.2 | 4.0.5, 4.1.3, 4.2.2 |
| 2018-12-12 | SS-2018-020: Potential SQL vulnerability in PostgreSQL database connector Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=4.0.0,<4.0.6 | >=4.1.0,<4.1.4 | >=4.2.0,<4.2.3 | 4.0.6, 4.1.4, 4.2.3 |
| 2018-07-17 | SS-2018-018: Database credentials disclosure during connection failure Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.7.0,<3.7.1 | >=4.0.0,<4.0.5 | >=4.1.0,<4.1.3 | >=4.2.0,<4.2.2 | 3.7.1, 4.0.5, 4.1.3, 4.2.2 |
| 2018-05-24 | SS-2018-006: Code execution vulnerability Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=4.0.3,<4.0.4 | >=4.1.0,<4.1.1 | 4.0.4, 4.1.1 |
| 2018-05-24 | SS-2018-013: Passwords sent back to browsers under some circumstances Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.5.5,<3.7.0 | >=4.0.3,<4.0.4 | >=4.1.0,<4.1.1 | 3.7.0, 4.0.4, 4.1.1 |
| 2018-05-24 | SS-2018-005: isDev and isTest unguarded Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=4.0.0,<4.0.4 | >=4.1.0,<4.1.1 | 4.0.4, 4.1.1 |
| 2018-05-24 | SS-2018-008: BackURL validation bypass with malformed URLs Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=4.0.0,<4.0.4 | >=4.1.0,<4.1.1 | 4.0.4, 4.1.1 |
| 2018-05-24 | SS-2018-010: Member disclosure in login form Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=4.0.0,<4.0.4 | >=4.1.0,<4.1.1 | 4.0.4, 4.1.1 |
| 2018-05-24 | SS-2018-012: Uploaded PHP script execution in assets Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=4.0.0,<4.0.4 | >=4.1.0,<4.1.1 | 4.0.4, 4.1.1 |
| 2018-05-14 | SS-2018-014: Dangerous file types in allowed upload Advisory · GitHub, FriendsOfPHP/security-advisories | critical | >=3.6.5,<3.6.6 | >=4.0.3,<4.0.4 | >=4.1.0,<4.1.1 | 3.6.6, 4.0.4, 4.1.1 |
| 2018-05-10 | SS-2018-001: Privilege Escalation Risk in Member Edit form Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=3.5.7,<3.5.8 | >=3.6.0,<3.6.6 | >=4.0.0,<4.0.4 | >=4.1.0,<4.1.1 | 3.5.8, 3.6.6, 4.0.4, 4.1.1 |
| 2017-12-07 | SS-2017-010: install.php discloses sensitive data by pre-populating DB credential forms Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=4.0.0,<4.0.1 | 4.0.1 |
| 2017-12-07 | SS-2017-007: CSV Excel Macro Injection Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=3.5.0,<3.5.6 | >=3.6.0,<3.6.3 | >=4.0.0,<4.0.1 | 3.5.6, 3.6.3, 4.0.1 |
| 2017-12-07 | SS-2017-006: Session user agent change detection Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.5.0,<3.5.6 | >=3.6.0,<3.6.3 | 3.5.6, 3.6.3 |
| 2017-12-07 | SS-2017-009: Users inadvertently passing sensitive data to LoginAttempt Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.5.0,<3.5.6 | >=3.6.0,<3.6.3 | >=4.0.0,<4.0.1 | 3.5.6, 3.6.3, 4.0.1 |
| 2017-12-07 | SS-2017-008: SQL injection in full text search of SilverStripe 4 Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.5.0,<3.5.6 | >=3.6.0,<3.6.3 | >=4.0.0,<4.0.1 | 3.5.6, 3.6.3, 4.0.1 |
| 2017-09-28 | SS-2017-005: User enumeration via timing attack on login and password reset forms Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.5.0,<3.5.5 | >=3.6.0,<3.6.2 | 3.5.5, 3.6.2 |
| 2017-05-30 | SS-2017-004: XSS in page history comparison Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=3.4.0,<3.4.6 | >=3.5.0,<3.5.4 | 3.4.6, 3.5.4 |
| 2017-05-30 | SS-2017-003: XSS in RedirectorPage Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=3.4.0,<3.4.6 | >=3.5.0,<3.5.4 | 3.4.6, 3.5.4 |
| 2017-05-30 | SS-2017-002: Member disclosure in login form Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.4.0,<3.4.6 | >=3.5.0,<3.5.4 | 3.4.6, 3.5.4 |
| 2017-01-31 | SS-2017-001: XSS In page name Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.4.0,<3.4.4 | >=3.5.0,<3.5.2 | 3.4.4, 3.5.2 |
| 2016-11-18 | SS-2016-016: XSS In CMSSecurity BackURL Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.1.0,<3.1.21 | >=3.2.0,<3.2.6 | >=3.3.0,<3.3.4 | >=3.4.0,<3.4.2 | 3.1.21, 3.2.6, 3.3.4, 3.4.2 |
| 2016-11-18 | SS-2016-010: ReadOnly transformation for formfields exploitable Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.1.0,<3.1.21 | >=3.2.0,<3.2.6 | >=3.3.0,<3.3.4 | >=3.4.0,<3.4.2 | 3.1.21, 3.2.6, 3.3.4, 3.4.2 |
| 2016-08-15 | SS-2016-007: VersionedRequestFilter vulnerability Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.3.2,<3.3.3 | >=3.4.0,<3.4.1 | 3.3.3, 3.4.1 |
| 2016-05-11 | SS-2016-004: XSS in CMS Edit Page Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.1.18,<3.1.19 | >=3.2.3,<3.2.4 | >=3.3.1,<3.3.2 | 3.1.19, 3.2.4, 3.3.2 |
| 2016-05-11 | SS-2016-006: Missing CSRF protection in login form Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.1.18,<3.1.19 | >=3.2.3,<3.2.4 | >=3.3.1,<3.3.2 | 3.1.19, 3.2.4, 3.3.2 |
| 2016-05-11 | SS-2016-005: Brute force bypass on default admin Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.1.18,<3.1.19 | >=3.2.3,<3.2.4 | >=3.3.1,<3.3.2 | 3.1.19, 3.2.4, 3.3.2 |
| 2016-02-18 | SS-2016-003: Hostname, IP and Protocol Spoofing through HTTP Headers Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.1.0,<3.1.17 | >=3.2.0,<3.2.2 | >3.2,<3.3.0 | 3.1.17, 3.2.2, 3.3.0 |
| 2016-02-17 | SS-2015-028: Missing security check on dev/build/defaults Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.1.0,<3.1.17 | >=3.2.0,<3.2.2 | >3.2,<3.3.0 | 3.1.17, 3.2.2, 3.3.0 |
| 2016-02-17 | SS-2016-002: CSRF vulnerability in GridFieldAddExistingAutocompleter Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.1.0,<3.1.17 | >=3.2.0,<3.2.2 | >3.2,<3.3.0 | 3.1.17, 3.2.2, 3.3.0 |
| 2015-11-13 | SS-2015-027: HtmlEditor embed url sanitisation Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.0.0,<3.1.0 | >=3.1.0,<3.2.0 | >=3.2.0,<3.2.1 | 3.1.0, 3.2.0, 3.2.1 |
| 2015-11-11 | SS-2015-026: Form field validation message XSS vulnerability Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.0.0,<3.1.0 | >=3.1.0,<3.1.16 | >=3.2.0,<3.2.1 | 3.1.0, 3.1.16, 3.2.1 |
| 2015-09-14 | SS-2015-016: XSS in install.php Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.1.0,<3.1.14 | 3.1.14 |
| 2015-09-14 | SS-2015-015: XSS in dev/build returnURL Parameter Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.1.0,<3.1.14 | 3.1.14 |
| 2015-05-29 | SS-2015-013: X-Forwarded-Host request hostname injection Advisory · GitHub, FriendsOfPHP/security-advisories | low | >=3.1.0,<3.1.13 | 3.1.13 |
| 2015-05-28 | SS-2015-014: Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.0.0,<3.0.14 | >=3.1.0,<3.1.13 | 3.0.14, 3.1.13 |
| 2015-05-25 | SS-2015-012: External redirection risk in Security?ReturnURL Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=3.0.0,<3.0.14 | >=3.1.0,<3.1.13 | 3.0.14, 3.1.13 |
| 2015-05-25 | SS-2015-011: Potential SQL Injection Vulnerability Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=3.0.0,<3.0.14 | >=3.1.0,<3.1.13 | 3.0.14, 3.1.13 |
| 2015-03-20 | SS-2016-008: Password encryption salt expiry Advisory · GitHub, FriendsOfPHP/security-advisories | low | >=3.1.19,<3.1.20 | >=3.2.4,<3.2.5 | >=3.3.2,<3.3.3 | >=3.4.0,<3.4.1 | 3.1.20, 3.2.5, 3.3.3, 3.4.1 |
| 2015-03-20 | SS-2016-014: Pre-existing alc_enc cookies log users in if remember me is disabled Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.1.19,<3.1.20 | >=3.2.4,<3.2.5 | >=3.3.2,<3.3.3 | >=3.4.0,<3.4.1 | 3.1.20, 3.2.5, 3.3.3, 3.4.1 |
| 2015-03-20 | SS-2016-012: Missing ACL on reports Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.1.19,<3.1.20 | >=3.2.4,<3.2.5 | >=3.3.2,<3.3.3 | >=3.4.0,<3.4.1 | 3.1.20, 3.2.5, 3.3.3, 3.4.1 |
| 2015-03-20 | SS-2016-013: Member.Name is not escaped Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.1.9,<3.1.20 | >=3.2.4,<3.2.5 | >=3.3.2,<3.3.3 | >=3.4.0,<3.4.1 | 3.1.20, 3.2.5, 3.3.3, 3.4.1 |
| 2015-03-20 | SS-2016-011: ChangePasswordForm does not check Member::canLogIn() Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=3.1.19,<3.1.20 | >=3.2.4,<3.2.5 | >=3.3.2,<3.3.3 | >=3.4.0,<3.4.1 | 3.1.20, 3.2.5, 3.3.3, 3.4.1 |
| 2015-03-20 | SS-2016-015: XSS In OptionsetField and CheckboxSetField Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.1.19,<3.1.20 | >=3.2.4,<3.2.5 | >=3.3.2,<3.3.3 | >=3.4.0,<3.4.1 | 3.1.20, 3.2.5, 3.3.3, 3.4.1 |
| 2015-03-20 | SS-2015-010: XSS in Director::force_redirect() Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.1.0,<3.1.12 | 3.1.12 |
| 2015-03-20 | SS-2015-009: XSS In rewritten hash links Advisory · GitHub, FriendsOfPHP/security-advisories | low | >=3.0.0,<3.0.13 | >=3.1.0,<3.1.12 | 3.0.13, 3.1.12 |
| 2015-03-20 | SS-2014-015: IE requests not properly behaving with rewritehashlinks Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.0.0,<3.0.13 | >=3.1.0,<3.1.12 | 3.0.13, 3.1.12 |
| 2015-02-12 | SS-2015-006: XSS In GridField print Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=3.1.0,<3.1.10 | 3.1.10 |
| 2015-02-12 | SS-2015-007: XSS In FormAction Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.1.0,<3.1.10 | 3.1.10 |
| 2015-02-12 | SS-2015-004: TreeDropdownField and TreeMultiSelectField XSS Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.1.0,<3.1.10 | 3.1.10 |
| 2014-08-12 | SS-2014-017: XML Quadratic Blowup Attack Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=3.1.0,<3.1.12 | 3.1.12 |
Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.
Ask about a fixCheck your whole project. Paste your composer.lock and see every installed package with a known advisory. Nothing is stored.
Check composer.lockQuestions about silverstripe/framework
Does silverstripe/framework have known vulnerabilities?
Yes. Packagist lists 103 security advisories for silverstripe/framework (3 critical, 13 high, 69 medium, 8 low severity). The most recent, reported 2026-10-28, is "CVE-2026-88988 - XSS via SVG data URI". The newest release, 6.3.2, is outside every affected range.
Which version of silverstripe/framework should I run?
The newest stable release is 6.3.2 (published 2026-11-02). The most recent advisory is fixed in 6.2.13, so stay on or above the fixed version for your major version. Run composer update silverstripe/framework, then composer audit to confirm nothing else is flagged.
How do I check if my silverstripe/framework version is affected?
Run composer show silverstripe/framework in your project to see the installed version, then enter it in the version check on this page. You can also run composer audit, which reads the same Packagist advisory data for every package in your composer.lock.