CVE-2026-55779

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage() in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CAST_HTML and inserts $restoredItem->Title, $restoredItem->URLSegment, $restoredItem->CMSEditLink(), and $changedProperty['value'] without applying Convert::raw2xml(). When an administrator restores an archived page containing a crafted title or URL segment, the generated restoration message can execute stored JavaScript in the administrator's browser, compromising the confidentiality and integrity of the CMS session. This issue is fixed in version 3.2.1.

• CWE-79

• https://github.com/silverstripe/silverstripe-versioned/commit/6e30a2cf8d4b9233690464da61bd0fc4d3e92952
• https://github.com/silverstripe/silverstripe-versioned/pull/541
• https://github.com/silverstripe/silverstripe-versioned/releases/tag/3.2.1
• https://github.com/silverstripe/silverstripe-versioned/security/advisories/GHSA-m4g4-86qc-v8w7
• https://www.silverstripe.org/download/security-releases/cve-2026-55779

Published

Aug 28, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55773CedarJava is an open source Java implementation of the Cedar…8.8
• CVE-2026-55774OpenBao is an open source identity-based secrets management …2.1
• CVE-2026-55775OpenBao is an open source identity-based secrets management …2.3
• CVE-2026-55776OpenBao is an open source identity-based secrets management …6.5
• CVE-2026-55777GoAccess is a real-time web log analyzer and interactive vie…5.3
• CVE-2026-55778Parse Server is an open source backend that can be deployed …2.1
• CVE-2026-5578A vulnerability was found in CodeAstro Online Classroom 1.0.…6.3
• CVE-2026-55780NanaZip is the 7-Zip derivative intended for the modern Wind…2.4
• CVE-2026-55781NanaZip is the 7-Zip derivative intended for the modern Wind…2.4
• CVE-2026-55782NanaZip is the 7-Zip derivative intended for the modern Wind…2.4
• CVE-2026-55783NanaZip is the 7-Zip derivative intended for the modern Wind…2.4
• CVE-2026-55784free5GC is an open-source implementation of the 5G core netw…7.5