CVE-2026-54721

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user with permission to configure a UserForms email recipient can use the subject field to run arbitrary code on the server, compromising confidentiality, integrity, and availability. This issue is fixed in versions 6.4.9, 7.0.7, and 7.1.1.

• CWE-94

• https://github.com/silverstripe/silverstripe-userforms/commit/23c069866900c19b499bfa997d1e251e97491702
• https://github.com/silverstripe/silverstripe-userforms/commit/c55494ad7c717b199a3c1663b43a54db5d95604c
• https://github.com/silverstripe/silverstripe-userforms/pull/1441
• https://github.com/silverstripe/silverstripe-userforms/pull/1442
• https://github.com/silverstripe/silverstripe-userforms/releases/tag/6.4.9
• https://github.com/silverstripe/silverstripe-userforms/releases/tag/7.0.7
• https://github.com/silverstripe/silverstripe-userforms/releases/tag/7.1.1
• https://github.com/silverstripe/silverstripe-userforms/security/advisories/GHSA-g8wr-r2v2-vqc6

Published

Aug 27, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54716Valhalla is an open source routing engine and accompanying l…7.5
• CVE-2026-54717Silverstripe CMS is an open source content management system…5.4
• CVE-2026-54718Silverstripe Advanced Workflow is a highly configurable step…7.2
• CVE-2026-54719goshs is a feature-rich single-binary file server for red te…7.5
• CVE-2026-5472A flaw has been found in ProjectsAndPrograms School Manageme…6.3
• CVE-2026-54720Silverstripe Framework is a PHP framework which powers the S…5.4
• CVE-2026-54722DSSRF is a Node.js library that provides a wide range of uti…8.7
• CVE-2026-54723devpi is a Python package index staging server and packaging…6.5
• CVE-2026-54724Kiwi TCMS is an open source test management system. Prior to…6.1
• CVE-2026-54725vault-secrets-webhook is a Kubernetes mutating webhook that …9.6
• CVE-2026-54727proot-distro is a utility for managing proot containers. Pri…8.2
• CVE-2026-54728bunkerweb is an Open-source and next-generation Web Applicat…6.1