-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| silverstripe/framework | composer | >= 3.1.0, <= 3.1.9 | 3.1.10 |
Miggo AIRoot Cause AnalysisThe vulnerability arises from unescaped user-controlled titles in FormAction fields. The commit patching this adds XML encoding in the Title() method and updates the template to use $Title.XML. The pre-patch FormAction constructor and Title method passed titles directly to templates without adequate encoding, making them the root cause. The template change (FormAction.ss) confirms the output was previously unescaped. Other changes (e.g., TreeDropdownField) reinforce the pattern of enforcing encoding at the field level.