CVE-2026-55779: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in silverstripe silverstripe-versioned

Silverstripe Versioned prior to 3.2.1 contains a stored cross-site scripting vulnerability in the RestoreAction::getRestoreMessage() method. This method generates restoration messages rendered as CAST_HTML and inserts unescaped user-controllable data including $restoredItem->Title, $restoredItem->URLSegment, $restoredItem->CMSEditLink(), and $changedProperty['value'] without applying Convert::raw2xml() encoding. An attacker who crafts a malicious title or URL segment in an archived page can cause stored JavaScript to execute in the browser of an administrator restoring that page, potentially compromising the CMS session's confidentiality and integrity. The vulnerability is addressed by proper encoding in version 3.2.1.

Successful exploitation allows stored JavaScript to run in the context of an administrator's browser session when restoring an archived page. This can lead to compromise of the confidentiality and integrity of the CMS session, potentially allowing an attacker to perform unauthorized actions or steal sensitive information within the CMS environment. There is no indication of availability impact. The CVSS score is 5.4 (medium severity).

This vulnerability is fixed in Silverstripe Versioned version 3.2.1. Users should upgrade to version 3.2.1 or later to remediate this issue. No other mitigation or temporary workaround is indicated. Patch status is not explicitly stated beyond the fix in 3.2.1, so users should consult the vendor advisory for the latest remediation guidance.