CVE-2020-9309

Silverstripe CMS through 4.5 can be susceptible to script execution from malicious upload contents under allowed file extensions (for example HTML code in a TXT file). When these files are stored as protected or draft files, the MIME detection can cause browsers to execute the file contents. Uploads stored as protected or draft files are allowed by default for authorised users only, but can also be enabled through custom logic as well as modules such as silverstripe/userforms. Sites using the previously optional silverstripe/mimevalidator module can configure MIME whitelists rather than extension whitelists, and hence prevent this issue. Sites on the Common Web Platform (CWP) use this module by default, and are not affected.

• CWE-434

• https://www.silverstripe.org/download/security-releases/CVE-2020-9309Vendor Advisory
• https://www.silverstripe.org/download/security-releases/CVE-2020-9309Vendor Advisory

Published

Jul 15, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-9299There were XSS vulnerabilities discovered and reported in th…5.4
• CVE-2020-9300The Access Control issues include allowing a regular user to…6.5
• CVE-2020-9301Nolan Ray from Apple Information Security identified a secur…8.8
• CVE-2020-9306Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has…8.8
• CVE-2020-9307Hirschmann OS2, RSP, and RSPE devices before HiOS 08.3.00 al…6.5
• CVE-2020-9308archive_read_support_format_rar5.c in libarchive before 3.4.…8.8
• CVE-2020-9310Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-9311In SilverStripe through 4.5, malicious users with a valid Si…5.4
• CVE-2020-9314** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web…4.8
• CVE-2020-9315** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web…7.5
• CVE-2020-9318Red Gate SQL Monitor 9.0.13 through 9.2.14 allows an adminis…7.2
• CVE-2020-9320Avira AV Engine before 8.3.54.138 allows virus-detection byp…5.5