5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-30148

CVE-2025-30148: Silverstripe Framework has a XSS vulnerability in HTML editor

Impact

A bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't catch it.

The server-side sanitisation logic has been updated to sanitise against this attack.

Reported by

James Nicoll from Fujitsu Cyber

References

https://www.silverstripe.org/download/security-releases/cve-2025-30148

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-30148

CVE-2025-30148:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
silverstripe/framework	composer	< 5.3.23	5.3.23

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stemmed from an insufficient regular expression generated by the private method SilverStripe\Core\XssSanitiser::getStripAttributeContentsRegex(). This regex failed to account for backspace characters (\x08) at the beginning or end of attribute values, which could be used to bypass XSS filters. The patch directly addresses this by modifying the regex in getStripAttributeContentsRegex().

The public methods SilverStripe\Core\XssSanitiser::sanitise() and SilverStripe\Forms\HTMLEditor\HTMLEditorSanitiser::sanitise() are responsible for the actual sanitization of user-provided HTML content. They would use the (previously flawed) regex generated by getStripAttributeContentsRegex(). Therefore, these sanitise methods were the entry points where the vulnerability would manifest, as they would fail to properly neutralize malicious input containing the backspace character bypass. The updated test cases in XssSanitiserTest.php and HTMLEditorSanitiserTest.php confirm that these sanitise methods were indeed affected by this bypass technique and are now tested against it.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.