CVE-2026-55779

Executive Summary

CVE-2026-55779 is a stored cross-site scripting (XSS) vulnerability in Silverstripe Versioned, the extension that provides versioning and archiving capabilities for Silverstripe CMS models. Prior to version 3.2.1, the RestoreAction::getRestoreMessage() method in src/RestoreAction.php fails to sanitize user-controlled data before rendering it as HTML in the ArchiveAdmin restoration notice. An administrator who restores an archived page containing a crafted title or URL segment will trigger execution of stored JavaScript in their own browser session, potentially allowing an attacker who can influence archived content to compromise the confidentiality and integrity of the CMS administration session. The vulnerability carries a CVSS score of 5.4 and is currently unpatched in environments running versions below 3.2.1.

Technical Analysis

The vulnerability resides in the Silverstripe Versioned module's ArchiveAdmin restoration workflow. When an administrator restores an archived page, the system generates a confirmation/notification message via RestoreAction::getRestoreMessage() located in src/RestoreAction.php. This notification is rendered as CAST_HTML, meaning the string is injected into the page as raw HTML without output encoding.

The message template interpolates the following values without applying Convert::raw2xml():

• $restoredItem->Title — the page title of the restored item
• $restoredItem->URLSegment — the URL slug of the restored item
• $restoredItem->CMSEditLink() — the CMS edit link for the restored item
• $changedProperty['value'] — values from changed property tracking during restoration

Because none of these values undergo HTML entity encoding before being embedded in the CAST_HTML notification, any HTML or JavaScript payload stored within these fields will be interpreted as markup when the notification renders. This is a classic stored XSS pattern: the malicious payload is persisted in the data store (in this case, as the title or URL segment of an archived page), and the triggering action (restoration by an administrator) causes it to execute in a privileged context.

Attack surface: The primary entry point is the archived-pages management interface (ArchiveAdmin). The vulnerability class is CWE-79 (Cross-Site Scripting — Improper Neutralization of Input During Web Page Generation). The flaw is the missing output encoding on server-side rendering of user-supplied data into an HTML context.

From a code-level perspective, the missing Convert::raw2xml() calls represent a failure to enforce output encoding at the point of rendering. This is a well-understood class of vulnerability — the data entering the template is trusted by the rendering pipeline, but the trust boundary was crossed upstream when an attacker (with sufficient privileges to create or modify archived content) embedded script content into a title or URL segment.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N indicates: network-accessible attack vector, low attack complexity, no privileges required to interact with the vulnerable component, but user interaction (the administrator performing a restore action) is required. The scope is unchanged, and the confidentiality and integrity impacts are rated low.

Exploitation Scenarios

Prerequisite conditions: The attacker requires the ability to influence the title or URL segment of content that will eventually be archived within a Silverstripe CMS. In many configurations, content authors or editors have the ability to create pages with custom titles and URL slugs. In multi-tenant deployments or CMS platforms with self-service publishing, this may effectively be achievable by any unprivileged user with content-creation rights.

1) Reconnaissance/Target Identification

The attacker identifies a Silverstripe CMS instance running the Versioned module at a version prior to 3.2.1. This can be done through version fingerprinting in HTTP headers, generated page metadata, or known patterns in the CMS's publicly accessible content.

2) Crafted Content Injection

The attacker creates or modifies a page/record, embedding a JavaScript payload into the title field or URLSegment (URL slug). For example:

• Title: Welcome<script>/* payload */</script>
• URLSegment: home<script>/* payload */</script>

This content is stored server-side. The attacker then archives the page, ensuring it enters the archived state where it will eventually be processed by the ArchiveAdmin restoration workflow. The malicious payload persists in the database.

3) Triggering the Payload — Administrator Interaction

A CMS administrator navigates to the ArchiveAdmin section to restore the archived page. When the restoration is initiated, RestoreAction::getRestoreMessage() constructs the notification message, embedding the unsanitized title/URLSegment values. The notification renders as HTML, and the embedded <script> executes in the administrator's browser context, with the administrator's session cookie and CMS privileges.

4) Post-Exploitation Impact

With the administrator's session compromised, the attacker can:

• Perform any administrative action the administrator could perform (managing users, modifying site content, changing site configuration)
• Exfiltrate sensitive information accessible through the CMS
• Potentially pivot to server-side exploitation if the CMS allows file uploads or template editing

No public PoC is available; the attack chain above is inferred from the vulnerability class and the NVD description.

Proof of Concept Intelligence

Status: No public proof-of-concept is currently available. No exploit code, Nuclei template, or Metasploit module has been disclosed for this vulnerability as of this report's writing.

Why exploitation may still be possible despite no public PoC:

The vulnerability class (stored XSS via missing output encoding) is well-understood and trivial to exploit once the vulnerable code path is identified. The NVD description provides sufficient detail — including the exact file (src/RestoreAction.php), the method (getRestoreMessage()), the affected fields (Title, URLSegment, CMSEditLink(), changedProperty['value']), and the missing encoding function (Convert::raw2xml()) — for a competent penetration tester to craft a working exploit within hours. The absence of a public PoC reflects a lack of disclosure activity, not a lack of exploitability.

Resources defenders should monitor:

• NVD/CVE feeds: Watch for updated CPE configurations, vendor advisories, and newly published PoC links
• GitHub/GitLab: Monitor for repositories containing exploit code referencing CVE-2026-55779
• Exploit-DB, Metasploit Framework, and Nuclei template repositories: New templates or modules may appear as researchers reverse-engineer the patch in version 3.2.1
• Security research blogs and Twitter/X: Security researchers often publish analyses when a patch commits to a project's public repository
• Silverstripe security advisories: The vendor's official security announcements page

Impact Assessment

Business Impact: The primary affected party is the CMS administrator. A successful attack results in stored XSS executing in the administrator's browser within the CMS administration context. This enables session hijacking that can lead to unauthorized changes to site content, user account manipulation, and exposure of CMS-accessible sensitive data.

Affected Systems: Any Silverstripe CMS deployment using the Versioned module (core to most Silverstripe installations for page versioning and archiving) at a version prior to 3.2.1. The exploitation requires the ArchiveAdmin interface to be enabled and the restore action to be accessible.

Blast Radius per CVSS 3.1 Vector:

• Attack Vector: Network (AV:N) — remotely exploitable over the network
• Attack Complexity: Low (AC:L) — no special conditions required beyond crafted stored content
• Privileges Required: None (PR:N) — no authentication needed to interact with the vulnerable rendering, though crafting the stored payload requires content-creation rights
• User Interaction: Required (UI:R) — administrator must trigger the restore action
• Confidentiality Impact: Low (C:L) — limited data exposure via the XSS context
• Integrity Impact: Low (I:L) — attacker can perform actions within the compromised session scope
• Availability Impact: None (A:N)
• Scope: Unchanged (S:U) — the CMS application security boundary

Overall Severity: Medium-end risk (CVSS 5.4). While the individual confidentiality and integrity impacts are low, the privileged context in which the script executes (CMS administrator) elevates the real-world risk. A compromised admin session in a CMS environment often serves as a stepping stone to full server compromise via CMS features such as template editing or file upload.

Detection Guidance

Sigma Rule

title: Silverstripe ArchiveAdmin Stored XSS - Restore Notification
id: 9f8e4c2a-7b31-4e6d-9a2c-3d1b5f8e7a42
status: experimental
description: Detects potential exploitation of CVE-2026-55779 - stored XSS in Silverstripe Versioned ArchiveAdmin restore messages
author: Valtersit Threat Intelligence
date: 2026-01-07
logsource:
  category: web_application
  product: silverstripe
detection:
  selection_webserver:
    cs-method: POST
    cs-uri-query|contains:
      - 'action_restore'
      - 'ArchiveAdmin'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'javascript:'
      - 'onerror='
      - 'onload='
  condition: selection_webserver and selection_payload
level: high
falsepositives:
  - Legitimate page titles containing HTML-like content (rare in practice)
tags:
  - attack.t1190
  - cve.2026-55779
  - cwe.79

YARA Rule

rule Silverstripe_CVE_2026_55779_Stored_XSS
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects Silverstripe restore notification HTML payloads indicative of CVE-2026-55779 stored XSS"
        cve_id = "CVE-2026-55779"
        cwe_id = "CWE-79"
        severity = "medium"
        date = "2026-01-07"
    strings:
        $a = /<script[^>]*>.*<\/script>/s
        $b = /onerror\s*=\s*[\"']?[a-z]+:/
        $c = /onload\s*=\s*[\"']?[a-z]+:/
        $d = /src\s*=\s*[\"']?javascript:/
        $e = "getRestoreMessage"
        $f = "CAST_HTML"
        $g = "RestoreAction"
    condition:
        uint16(0) == 0x3C3C or
        (
            ($e or $f or $g) and
            any of ($a, $b, $c, $d)
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"SILVERSTRIPE CVE-2026-55779 Stored XSS Attempt - ArchiveAdmin Restore";
    flow:established,to_server;
    http.method;
    content:"POST";
    http.uri;
    content:"ArchiveAdmin";
    http.uri;
    content:"restore";
    http.client_body;
    pcre:"/(<script|javascript:|onerror\s*=|onload\s*=)/i";
    reference:cve,2026-55779;
    classtype:web-application-attack;
    sid:20265577901;
    rev:1;
    metadata:created_at 2026_01_07, updated_at 2026_01_07;
)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where event.type == "connection" and
   destination.port == 80 or destination.port == 443]
  [http where event.category == "web" and
   http.request.method == "POST" and
   url.path like "*ArchiveAdmin*" and
   url.path like "*restore*"]
  [http where event.category == "web" and
   http.response.status_code == 200 and
   (http.response.body.text like "*<script>*" or
    http.response.body.text like "*onerror=*" or
    http.response.body.text like "*javascript:*")]

Splunk SPL Query

index=web sourcetype=access_combined
| search "POST" AND ("ArchiveAdmin" OR "action_restore")
| rex field=_raw "POST (?<uri>\S+)"
| search uri="*ArchiveAdmin*restore*"
| rex field=_raw "\"(?<payload>.*?)\"" 
| search payload IN ("*<script*", "*javascript:*", "*onerror=*", "*onload=*")
| eval cve_id="CVE-2026-55779"
| table _time, src_ip, dest_ip, uri, status, payload
| sort -_time

Wazuh OSSEC Rule

<group name="silverstripe, xss,">
  <rule id="701435" level="10">
    <decoded>Silverstripe ArchiveAdmin restore request with XSS payload patterns</decoded>
    <match>ArchiveAdmin</match>
    <match>action_restore</match>
    <regex>(&lt;script|javascript:|onerror\s*=|onload\s*=)</regex>
    <description>CVE-2026-55779: Potential stored XSS attempt via Silverstripe Versioned ArchiveAdmin restore</description>
    <group>attack.t1190, cwe.79,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

1) Immediate Mitigations (while awaiting patch deployment):

• Restrict ArchiveAdmin access: Limit access to the ArchiveAdmin restore functionality to only trusted, high-privilege administrators. Implement network-level access controls (IP allowlists, VPN) if possible.
• Manual input validation: If you cannot upgrade immediately, add a server-side filter to reject page titles or URL segments containing HTML markup characters (<, >, ", ', &) during content creation and archival workflows.
• CMS hardening: Disable or restrict the ability for lower-privileged users (authors/editors) to create content with custom URL segments. Force auto-generated URL slugs to reduce attack surface.
• Browser-level mitigations: Set X-XSS-Protection: 1; mode=block header (legacy but provides a minimal mitigation layer). More importantly, ensure the CMS admin interface is served over HTTPS to prevent cookie interception, and set the HttpOnly and SameSite=Strict flags on all session cookies.

2) Patch/Upgrade Steps:

• Upgrade Silverstripe Versioned to version 3.2.1 or later, which contains the fix applying Convert::raw2xml() to all values embedded in the restore notification message.
• Verify the installed version: check Composer/NVM dependencies or navigate to the CMS admin and review the module version information.
• After upgrading, audit any existing archived content with suspicious titles or URL segments for embedded HTML/script payloads. Purge or sanitize affected records.

3) Long-Term Hardening:

• Establish a formal dependency-update cadence for all Silverstripe modules — follow the vendor's security announcement channels (Silverstripe Security Advisories).
• Implement a Web Application Firewall (WAF) rule set that filters HTML/script payloads in POST requests to CMS administrative endpoints.
• Perform regular penetration testing of the CMS administrative interfaces with a focus on the archive/restoration workflows.
• Conduct a security code review of any custom modules that interact with RestoreAction or the ArchiveAdmin interface to ensure consistent output encoding practices (Convert::raw2xml(), Convert::raw2att(), etc.).

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-55779
2. Silverstripe Security Advisories: https://www.silverstripe.org/blog/tag/security-advisories/ (vendor's official security notification channel)
3. Silverstripe Versioned module documentation: https://github.com/silverstripe/silverstripe-versioned (source repository — monitor for the 3.2.1 release and patch commit)
4. Silverstripe Convert class documentation: https://api.silverstripe.org/ (reference for Convert::raw2xml() output encoding function)
5. CWE-79 (Cross-Site Scripting) reference: https://cwe.mitre.org/data/definitions/79.html

Exploit-in-the-Wild Evidence: No known threat actor campaigns or exploit-in-the-wild activity have been reported for this CVE as of the writing of this report. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.