CVE-2026-54721: Remote Code Execution via Server-Side Template Injection in Silverstripe UserForms

The silverstripe/silverstripe-userforms module provides visual drag-and-drop form building capabilities for the Silverstripe Content Management System (CMS). Content authors and administrators use this module to construct custom form pages and define automated email configurations, including auto-responders and recipient notifications. These features process dynamic form field values (such as $Name or $Email) and merge them into administrative email fields.

To perform this dynamic merge operation, the module leverages the core Silverstripe template rendering engine (SSViewer). This template engine compiles template strings into native PHP code to improve execution speed. During the compilation of fields like the email subject line, the engine supports custom template tags, including the translation helper syntax (<%t EntityID "Default Value" %>).

Because the administrative interface allows form-editing users to configure these templates, the email subject field acts as an entry point for untrusted inputs. If an attacker inputs template engine commands into this configuration field, those commands are processed within the privileged context of the server-side compiler, exposing a significant attack surface.

The root cause of this vulnerability lies in the parser design of the legacy Silverstripe template engine. Specifically, the parser handles translation tags by generating a native PHP representation that preserves double-quoted default string arguments. Under normal operations, this behavior is designed to facilitate standard variable interpolation within translation strings.

However, the parser fails to properly sanitize or isolate dynamic expressions nested within double quotes inside the translation tag. When compiling the syntax <%t EntityID "Default Value" %>, the parser outputs the default value string directly inside a double-quoted PHP string literal within the compiled template file.

Because the template engine preserves the double quotes in the compiled PHP output, any nested variable interpolation syntax—such as ${expression}—is directly evaluated by the PHP interpreter at runtime. The PHP runtime interprets this syntax as a dynamic variable name, executing the inner expression as a side-effect. This behavior, known as variable-variable evaluation, allows arbitrary function calls to be executed when the template is rendered.

When a frontend user submits a form built via the UserForms module, the execution flows through the UserDefinedFormController. This controller retrieves the associated EmailRecipient configuration and processes the subject template to generate the outgoing mail header. The following diagram illustrates this execution flow and the insertion of the vulnerability:

The vulnerability is introduced because the compiled template is stored in the local server cache and then executed by the Zend Engine. This architecture makes it critical to prevent dynamic code generation within any field editable by CMS users.

Exploitation of CVE-2026-54721 requires authentication to the Silverstripe CMS with privileges sufficient to edit form pages and configure email recipients. An attacker begins by identifying a form page and navigating to the email recipient configuration tab.

The attacker then injects a template translation string containing a nested PHP expression into the "Email Subject" field. An example payload uses the PHP file_put_contents function within the dynamic interpolation sequence to write a persistent web shell to the server:

<%t Exploit "{${\'file_put_contents\'(\'assets/shell.php\',\'<?php system($_GET["cmd"]); ?>\')}}" %>

Once the configuration is saved and published, the attacker triggers execution by submitting the corresponding frontend form. The submission invokes the UserDefinedFormController, which compiles and runs the malicious subject template. The PHP interpreter evaluates the inner file_put_contents function during variable interpolation, successfully creating the file assets/shell.php on the filesystem. The attacker can then issue system commands via HTTP requests directly to the newly created script.

The successful exploitation of CVE-2026-54721 results in complete compromise of the underlying web server host. Because the arbitrary code executes within the context of the web server process (e.g., www-data or apache), the attacker gains unauthorized read and write access to all files on the filesystem accessible to that user.

An attacker can read sensitive configuration files, including database credentials, API keys, and environment variables. If the database server is accessible from the web server, this exposure allows the attacker to compromise the entire database instance, exposing personal data and system records.

Furthermore, the ability to execute system-level commands allows the attacker to establish persistent access via reverse shells, download additional utility scripts, or attempt local privilege escalation to gain root-level control over the target infrastructure.

To address this vulnerability, the Silverstripe maintainers updated the template parser libraries in the core framework to ensure translation default values are parsed strictly as static literals. The fix is implemented across multiple active release branches.

Organizations must update their dependencies immediately using Composer. For CMS 6/7, update silverstripe/silverstripe-userforms to version 6.4.9, 7.0.7, or 7.1.1 to force the inclusion of silverstripe/template-engine version 1.0.1 or higher. For CMS 5, upgrade silverstripe/framework to version 5.4.30 or higher to resolve the issue in legacy template engines.

As an immediate mitigation for systems that cannot be patched instantly, administrators should restrict file execution permissions within writeable directories like assets/ by configuring web server rules to deny script interpretation inside user-upload zones.