CVE-2026-54721

Executive Summary

CVE-2026-54721 is a critical server-side code execution vulnerability in the Silverstripe UserForms module, a visual form builder for the Silverstripe CMS. An authenticated CMS user with permission to configure email recipients for a UserForms instance can inject a specially crafted payload into the email recipient subject field, which is subsequently interpreted as executable server-side code. This results in full compromise of confidentiality, integrity, and availability of the underlying server. The vulnerability affects UserForms versions from 6.0.0 through 6.4.9, 7.0.0 through 7.0.7, and 7.1.0 through 7.1.1, with fixes released in versions 6.4.9, 7.0.7, and 7.1.1 respectively.

The CVSS score of 8.8 (High) reflects the network-based attack vector, low attack complexity, and low privilege requirement, combined with the high impact on confidentiality, integrity, and availability. No public proof-of-concept code or exploit-in-the-wild activity has been observed at the time of writing. The issue is classified under CWE-94 (Improper Control of Generation of Code — Code Injection), indicating that user-controlled input is not adequately sanitized before being processed in a code-execution context.

Technical Analysis

Vulnerability Class and Mechanism

CVE-2026-54721 falls under CWE-94 (Code Injection), a vulnerability class characterized by the improper control of generated code where untrusted input is incorporated into code execution contexts without adequate sanitization. The vulnerable component is the "userform email recipient subject field" in the Silverstripe CMS administration interface.

The attack surface is the Silverstripe CMS administrative backend, specifically the configuration interface for UserForms email recipients. The subject field of an email recipient configuration is processed in a manner that allows "specially crafted payload[s]" to be "interpreted as executable server-side code." This indicates that the subject field value is being passed through an evaluation mechanism — likely PHP's eval(), a template engine that supports dynamic evaluation, or a similar code-execution construct — rather than being treated as static string data.

The vulnerability is only exploitable by an "authenticated CMS user with permission to configure a UserForms email recipient." This means the privilege requirement is low (CVSS PR:L) but not absent — an unauthenticated remote attacker cannot exploit this flaw directly. The attacker must have at least editor-level or administrator-level access to the CMS with the specific permission to modify email recipient configurations.

Attack Surface Details

The attack surface is limited to authenticated users managing UserForms configurations. The Email Recipient object in UserForms allows administrators to specify recipient email addresses, subject lines, and other email metadata. The subject field is the injection point.

Affected Component Flow

The injection flow is as follows: an authenticated attacker with permission to configure email recipients modifies the subject field of a UserForms email recipient configuration. The payload entered into the subject field is stored in the database. When the UserForms module subsequently processes email notifications (either at form submission time or when viewing/testing the configuration), the stored subject value is passed into a server-side code execution construct. Due to the lack of adequate input sanitization or output encoding, the payload is executed in the server's PHP runtime.

The "specially crafted payload" language suggests that there are specific syntax requirements for the payload to be interpreted as code — typical of template injection or evaluation-based injections. Examples of such payloads might include constructs that close an existing template context and introduce code, or direct calls to PHP functions. Since the description states payloads are "interpreted as executable server-side code," the evaluation mechanism accepts the entire subject value directly as code or within a code context.

Insufficient Technical Detail Note

The NVD description does not specify the exact code path, function names, or evaluation mechanism involved. It is not disclosed whether the flaw exists in a template engine (e.g., Silverstripe's template or a third-party template), in a direct eval() call, or in a custom implementation. Security researchers should obtain the patched source code for versions 6.4.9, 7.0.7, and 7.1.1 to perform a differential analysis against previously vulnerable versions to identify the precise fix. Without the patch or vendor advisory, the exact vulnerable function and code path cannot be definitively identified.

Exploitation Scenarios

Preconditions

To exploit CVE-2026-54721, an attacker must:

1. Possess valid credentials for a Silverstripe CMS instance running an affected UserForms version.
2. Hold a CMS role that grants permission to configure UserForms email recipients (typically an administrator or a custom role with the relevant access permissions).

Step 1: Reconnaissance and Target Identification

An attacker begins by identifying Silverstripe CMS instances running the UserForms module. This can be done through:

• Search engine queries for Silverstripe-specific page identifiers or files (e.g., /admin/ paths).
• Browsing public CMS content that uses form elements characteristic of UserForms.
• Scanning for the Silverstripe CMS login page and versification via HTTP response headers, generator meta tags, or published changelogs.

Once a target is found, the attacker must identify the UserForms version. This may be done through the CMS admin interface, exposed module files, or version disclosure in public-facing assets. Version strings matching affected ranges (6.0.0–6.4.9, 7.0.0–7.0.7, 7.1.0–7.1.1) indicate possible vulnerability.

Step 2: Authentication and Access to Configuration Interface

The attacker logs in with valid credentials. For a successful attack, the account must have the permission to configure UserForms email recipients. In many compromises, attackers first obtain lower-privileged credentials and then exploit additional vulnerabilities — or rely on weak password policies — to escalate to an account with the required privileges.

Step 3: Payload Injection

The attacker navigates to the UserForms email recipient configuration in the CMS admin interface. They modify the subject field of an existing email recipient or create a new one, inserting a specially crafted payload designed for the specific code-evaluation context (e.g., PHP function calls, template injection syntax, or shell command execution wrappers). Since no public PoC or exploit code is available and the NVD description does not provide specifics on the injection syntax, the attacker would need to reverse-engineer the vulnerable code or wait for the release of public research.

Step 4: Execution and Post-Exploitation

The payload executes when the subject field is processed by the server-side code interpreter. Timing of execution is not fully described, but it occurs during normal CMS operations involving the email recipient — such as testing the email configuration, triggering a form submission that sends an email, or saving the configuration (depending on where the evaluation occurs).

Successful exploitation yields arbitrary code execution with the privileges of the web server process (typically a limited system user such as www-data on Linux or IIS APPPOOL on Windows). Post-exploitation activities can include:

• Reading sensitive files from the filesystem (configuration files, database credentials, source code).
• Writing webshells to the web root for persistent access.
• Establishing reverse shells or outbound connections to attacker-controlled infrastructure.
• Dumping the CMS database, including user credentials and personal data submitted through forms.
• Privilege escalation to root/system if the web server process has elevated privileges or if additional local privilege escalation vulnerabilities exist.

Notes on Exploitation Feasibility

No public PoC or exploit code is available for this vulnerability as of the report date. The attack chain above is inferred from the vulnerability class (code injection) and the described attack vector. Actual exploitation requires knowledge of the specific code evaluation context, which can be obtained through reverse engineering of the vulnerable module or by consulting a forthcoming vendor advisory. The EPSS score has not yet been issued by FIRST.org, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Impact Assessment

CVSS Breakdown Interpretation

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H translates to:

• Attack Vector: Network (AV:N) — The attack is performed remotely over the network.
• Attack Complexity: Low (AC:L) — No special conditions are required for exploitation beyond the access prerequisites.
• Privileges Required: Low (PR:L) — The attacker needs valid credentials with permission to configure UserForms email recipients, which is a low bar compared to administrator-level access.
• User Interaction: None (UI:N) — No victim interaction is required.
• Scope: Unchanged (S:U) — The vulnerability affects only the security scope of the vulnerable component; the impact is contained to the CMS server.
• Confidentiality Impact: High (C:H) — Arbitrary code execution allows reading any data accessible to the web server process, including database contents and file system data.
• Integrity Impact: High (I:H) — The attacker can modify or delete any data accessible to the web server, including CMS content, configuration files, and source code.
• Availability Impact: High (A:H) — Code execution can be used to terminate processes, corrupt data, or otherwise render the CMS and possibly the host server unavailable.

The overall score of 8.8 (High) reflects the severity of full server compromise from a relatively low level of pre-existing access.

Business Impact

For organizations running Silverstripe CMS with the UserForms module, this vulnerability represents a significant risk:

1. Data Breach: Silverstripe CMS is frequently used by government agencies, educational institutions, and non-profits. UserForms often collects personal information (names, emails, addresses, supporting documents). Full server compromise could expose this sensitive data, leading to regulatory penalties (GDPR, HIPAA, etc.) and reputational damage.

2. Availability Disruption: An attacker can take down the server or deface the CMS, causing denial of service for the organization's web presence.

3. Lateral Movement: Server compromise provides a foothold from which an attacker could pivot to internal network resources, databases, or adjacent systems.

4. Supply Chain Risk: If the compromised instance is used for distributing content or services to downstream clients, the attacker could potentially inject malicious content.

Blast Radius

The blast radius is bounded by the privileges of the web server process on the host system. On typical shared hosting environments, the blast radius may extend to other sites hosted on the same server if the process isolation is insufficient. On dedicated or VPS deployments, the entire CMS content, configuration, and associated data are at risk.

Detection Guidance

Sigma Rule

The following Sigma rule detects potential exploitation attempts by monitoring administrative actions on UserForms email recipient configuration:

title: Silverstripe UserForms Email Recipient Subject Code Injection Attempt
id: 8f3d1c2e-5a4b-4c7d-9e6f-2a1b3c4d5e6f
status: experimental
description: >
  Detects modifications to the UserForms email recipient subject field that
  contain characters or patterns indicative of code injection attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-54721
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
  product: silverstripe
  category: application
  definition: >
    Audit logs must capture changes to UserForms email recipient configuration
    records.
detection:
  selection:
    EventType:
      - 'EmailRecipientModified'
      - 'EmailRecipientCreated'
    SubjectField|contains:
      - '${'
      - 'php'
      - 'eval'
      - 'system('
      - 'exec('
      - 'passthru('
      - 'shell_exec('
      - '`'
      - ';base64'
  condition: selection
  timeframe: 10m
level: high
falsepositives:
  - Legitimate use of template variables in subject lines (e.g., {{$Title}})
fields:
  - UserID
  - IPAddress
  - ActionURL
tags:
  - attack.t1203
  - cve.2026-54721

YARA Rule

The following YARA rule can be used to scan CMS backups, source code dumps, or log files for injection patterns targeting the UserForms subject field:

rule Silverstripe_UserForms_EmailSubject_CodeInjection_CVE_2026_54721
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects patterns indicative of code injection in Silverstripe UserForms email recipient subject fields"
        cve = "CVE-2026-54721"
        date = "2026-01-15"
        severity = "high"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-54721"
    
    strings:
        $inj_php_eval = "eval(" ascii nocase
        $inj_php_system = "system(" ascii nocase
        $inj_php_exec = "exec(" ascii nocase
        $inj_php_passthru = "passthru(" ascii nocase
        $inj_php_shell_exec = "shell_exec(" ascii nocase
        $inj_php_backtick = "`" ascii
        $inj_tpl_var = "${" ascii
        $inj_base64 = "base64_decode(" ascii nocase
        $inj_subject_ctx = "Subject" ascii nocase
        $inj_email_rec = "EmailRecipient" ascii nocase
        $inj_script_tag = "<script" ascii nocase
    
    condition:
        ($inj_subject_ctx or $inj_email_rec) and
        any of ($inj_php_eval, $inj_php_system, $inj_php_exec, $inj_php_passthru,
                $inj_php_shell_exec, $inj_php_backtick, $inj_tpl_var, 
                $inj_base64, $inj_script_tag) and
        filesize < 50MB
}

Suricata IDS Rule

Since the exploitation occurs in the CMS administrative interface over HTTP/HTTPS, the following Suricata rule detects anomalous POST/PUT requests to the admin email recipient configuration endpoint. Note: the exclusion of encrypted traffic means this rule is most effective in environments with SSL/TLS interception:

alert http any any -> $HOME_NET any (msg:"CVE-2026-54721 - Silverstripe UserForms Email Subject Code Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"admin"; http.uri; content:"userforms"; http.uri; content:"email"; http.request_body; content:"Subject"; within:200; http.request_body; pcre:"/(\$\{|eval\(|system\(|exec\(|passthru\(|shell_exec\(|base64_decode\(|<script)/i"; classtype:attempted-admin; sid:5000001; rev:1;)

# Alternative broader rule for any admin POST with injection patterns
alert http any any -> $HOME_NET any (msg:"CVE-2026-54721 - Potential Code Injection in Silverstripe Admin"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"admin"; http.request_body; pcre:"/(\$\{|eval\(|system\(|passthru\(|shell_exec\()/i"; classtype:attempted-admin; sid:5000002; rev:1;)

Elastic Detection

The following EQL query detects changes to UserForms email recipient records in audit logs:

sequence by user.id with maxspan=1m
  [any where event.action in ("EmailRecipientCreated", "EmailRecipientModified") and
   event.outcome == "success" and
   process.name == "*"]
  [file where event.action in ("change", "modify") and
   file.path contains "EmailRecipient" and
   file.path contains "Subject" and
   (string.contains(file.content, "${") or
    string.contains(file.content, "eval(") or
    string.contains(file.content, "system(") or
    string.contains(file.content, "shell_exec(") or
    string.contains(file.content, "base64_decode("))]

Splunk SPL Query

index=web sourcetype=access_combined OR index=web sourcetype=iis
| where like(uri, "%/admin/%") 
| regex _raw="(eval\(|system\(|exec\(|passthru\(|shell_exec\(|base64_decode\(|\$\{)"
| table _time, clientip, user, uri, method, status
| stats count by clientip, user, uri
| where count > 3
| sort - count

Additional Splunk query for audit logs:

index=silverstripe sourcetype=audit_log 
| where action IN ("EmailRecipientModified", "EmailRecipientCreated")
| regex Subject="(\$\{|eval\(|system\(|exec\(|passthru\(|shell_exec\(|base64_decode\(|<script)"
| table _time, user, ip_address, action, subject_value
| sort - _time

Wazuh OSSEC Rule

<rule id="100929" level="12">
  <if_sid>89001</if_sid>
  <regex>(\$\{|eval\(|system\(|exec\(|passthru\(|shell_exec\(|base64_decode\()</regex>
  <match>EmailRecipient|EmailRecipientSubject|userforms</match>
  <description>CVE-2026-54721 - Silverstripe UserForms email subject code injection attempt detected</description>
  <group>cve_2026_54721, silverstripe, code_injection,</group>
  <mitre>
    <id>T1203</id>
  </mitre>
</rule>

Mitigation & Patch Guidance

Patch Status

IMPORTANT CONFIDENTIALITY NOTE: The NVD description states that the issue "is fixed in versions 6.4.9, 7.0.7, and 7.1.1." However, the patch sources tracker reports a confidence of 0/4 (UNPATCHED) with no patch evidence from any tracked source. This discrepancy suggests that while the vendor has announced fixes, the patch has not been verified against tracked repositories, or the patch details have not been publicly disseminated through the channels monitored by our intelligence sources. The official vendor fix references available are: versions 6.4.9, 7.0.7, and 7.1.1 of the Silverstripe UserForms module.

Immediate Mitigations (until patches are verified)

1. Restrict Administrative Access: Limit the number of accounts with permission to configure UserForms email recipients. Review existing user roles and remove unnecessary permissions. Apply the principle of least privilege.

2. Audit Existing Configurations: Review all existing UserForms email recipient configurations for suspicious or anomalous subject field values. Look for patterns such as ${, eval(, system(, shell_exec(, base64_decode(, or other code-execution constructs.

3. Enable Multi-Factor Authentication (MFA): Require MFA for all CMS admin accounts to reduce the risk of credential compromise that would enable exploitation.

4. Network Segmentation: Ensure the CMS web server is isolated from critical internal networks to limit post-exploitation lateral movement.

5. Web Application Firewall (WAF) Rules: If a WAF is in place, deploy rules to flag or block requests containing code-execution patterns in admin-level POST requests (as shown in the Suricata and detection sections above).

6. Monitor Authentication and Configuration Logs: Increase the logging level for admin audit trails and monitor for unusual activity, especially changes to email recipient configuration.

Patch/Upgrade Steps

1. Verify Patch Availability: Check the Silverstripe UserForms module release on Packagist, the Silverstripe Marketplace, or the GitHub repository for versions 6.4.9, 7.0.7, and 7.1.1.

2. Upgrade Path:

   • Users on UserForms 6.x should upgrade to 6.4.9 or later.
   • Users on UserForms 7.0.x should upgrade to 7.0.7 or later.
   • Users on UserForms 7.1.x should upgrade to 7.1.1 or later.
   • Verify that the corresponding Silverstripe CMS core version is compatible with the upgraded UserForms version.

3. Post-Upgrade Validation: After upgrading, verify that email recipient configuration functions work correctly and that subject fields are no longer interpreted as executable code. Test with a benign payload (e.g., ${phpinfo()}) in a staging environment to confirm the fix.

4. Credential Rotation: As a precaution, rotate credentials for any accounts that had access to the CMS admin interface during the vulnerable period.

Long-Term Hardening

1. Input Validation and Output Encoding: Enforce strict input validation on all admin-configurable fields. Subject fields should be treated as plain strings and never passed to evaluation functions.

2. Dependency Management: Maintain an inventory of all Silverstripe modules and their versions. Subscribe to security advisories for the Silverstripe ecosystem and patch promptly.

3. Secure Coding Practices: For any custom development, follow OWASP guidelines for preventing code injection and template injection vulnerabilities. Use parameterized template functions and avoid eval() and similar constructs.

4. Runtime Protection: Consider deploying RASP (Runtime Application Self-Protection) solutions that can detect and block code execution in web applications.

5. Regular Security Reviews: Schedule periodic security assessments of the CMS, including code review, penetration testing, and configuration audit.

6. Incident Response Preparedness: Develop and rehearse an incident response plan for server compromise scenarios, including forensic collection procedures and communication protocols.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-54721 — Official NVD record containing the description, CVSS vector, and metadata.

2. Silverstripe UserForms Module: https://github.com/silverstripe/silverstripe-userforms — Official source repository where the patched versions (6.4.9, 7.0.7, 7.1.1) are expected to be released/tagged.

3. Silverstripe Marketplace: https://addons.silverstripe.org/ — Official module distribution platform where patched releases will be available for installation.

4. Silverstripe Security Advisories: https://www.silverstripe.org/download/security-releases/ — Vendor security advisory page, where the formal advisory referencing CVE-2026-54721 should be published.

5. CWE-94 Reference: https://cwe.mitre.org/data/definitions/94.html — Common Weakness Enumeration entry for Improper Control of Generation of Code ('Code Injection').

Additional Notes

• CISA KEV Status: This CVE is NOT listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing. No exploit-in-the-wild activity has been reported.
• EPSS Score: FIRST.org has not yet issued an EPSS score for this vulnerability. No prediction on exploit likelihood can be provided at this time.
• Threat Actor Activity: No known threat actor campaigns have been publicly attributed to this CVE. Monitoring should continue as more information becomes available.
• Patch Verification: The discrepancy between the NVD description mentioning fixed versions and the unverified patch status (0/4) should be resolved by checking the official Silverstripe package repositories directly. Once verification is completed, organizations should proceed with the upgrade path described above.