CVE-2026-55779: Stored Cross-Site Scripting (XSS) in Silverstripe Archive Admin Restore

The affected component is the RestoreAction helper within the silverstripe/versioned module, which manages the lifecycle, tracking, and restoration of versioned models in Silverstripe CMS applications. When an administrator accesses the ArchiveAdmin console and restores a previously archived object, the module constructs an execution status message. This message incorporates the restored object's metadata, such as its Title, URLSegment, and CMSEditLink.

Because the system treats system messages as validated HTML under the CAST_HTML formatting configuration, it does not perform automatic output sanitization on the rendered output. This behavior exposes a stored cross-site scripting (XSS) attack surface. Specifically, any malicious input stored in the draft or published attributes of a versioned page will bypass standard framework output filters and execute in the target's browser.

The vulnerability is tracked under CVE-2026-55779. It represents a classic improper neutralization of input during web page generation (CWE-79). The security impact is determined by the permissions of the user restoring the content. Since page restoration is restricted to administrative roles, the vulnerability targets high-privilege sessions within the CMS control panel.

The root cause of CVE-2026-55779 is the lack of output encoding within the getRestoreMessage method located in src/RestoreAction.php. The Silverstripe framework relies on casting rules to distinguish between plain text and rich HTML. When generating notification payloads, the framework treats the output as trusted HTML, assigning it a casting type equivalent to CAST_HTML.

In the vulnerable implementation, the getRestoreMessage method directly interpolates the title of the restored object ($restoredItem->Title) and its corresponding CMS edit URL into the notification string. This interpolation is executed via sprintf and string concatenation. Because these values originate from user-controlled fields and are stored within the database without restrictive input filtering, they serve as persistent vectors for injection payloads.

When the database stores malicious markup and subsequently retrieves it for display in the ArchiveAdmin, the lack of sanitization allows the markup to be rendered directly into the administrative UI. This bypasses the browser's same-origin boundary protections, allowing the executed script to make requests on behalf of the authenticated administrator.

The vulnerable logic resides in src/RestoreAction.php inside the getRestoreMessage function. In unpatched releases, the raw property values were assigned and used without any defensive filtering.

// Vulnerable Code Path
public static function getRestoreMessage($originalItem, $restoredItem, $changedLocation = false)
{
    // Raw Title is assigned directly without escaping
    $restoredID = $restoredItem->Title ?: $restoredItem->ID;
    $restoredType = Convert::raw2xml(strtolower($restoredItem->i18n_singular_name() ?? ''));
 
    $editLink = $restoredItem->CMSEditLink();
    if ($editLink) {
        // Unescaped restoredID and editLink are concatenated into an HTML anchor tag
        $restoredID = sprintf('<a href="%s">%s</a>', $editLink, $restoredID);
    }
    // ...
}

The fixing patch introduces Convert::raw2xml calls to properly escape all dynamic parameters. This utility is the standard Silverstripe mechanism for converting unsafe characters into XML entities.

// Patched Code Path
public static function getRestoreMessage($originalItem, $restoredItem, $changedLocation = false)
{
    // Escape the Title or ID property to prevent tag injection
    $restoredID = Convert::raw2xml($restoredItem->Title ?: $restoredItem->ID);
    $restoredType = Convert::raw2xml(strtolower($restoredItem->i18n_singular_name() ?? ''));
 
    $editLink = $restoredItem->CMSEditLink();
    if ($editLink) {
        // Escape both the target URL and the inner anchor text
        $restoredID = sprintf('<a href="%s">%s</a>', Convert::raw2xml($editLink), $restoredID);
    }
    // ...
}

Additionally, the patch applies Convert::raw2xml to the values generated during difference analysis. When the original Title or URLSegment differs from the restored state, the system records the new values. These must be escaped because they are subsequently rendered to describe the property modifications.

An attacker can exploit this vulnerability using multiple vectors depending on the configured fields. The primary vector involves the Title attribute of a page. The attacker injects an iframe payload containing a nested script tag: <iframe srcdoc="&lt;script&gt;alert('xss')&lt;/script&gt;"></iframe>. Once this page is archived, the payload resides in the historical versions tables.

The second vector exploits the change-tracking output when a page property is altered. By crafting a payload using the formaction attribute on a button, such as <button formaction="javascript:alert(1)">Click</button>, the attacker targets the administrator's UI interaction. If the restored page's Name differs from the original, this dynamic block is evaluated and rendered in the success message.

Both attack vectors require the victim to perform a page restoration action. While this introduces a dependency on user interaction, administrative actions of this type are routine during content maintenance cycles, making social engineering or passive waiting highly viable strategies.

The security impact of CVE-2026-55779 is rated as Medium, with a CVSS v3.1 base score of 5.4. Although the impact is localized to the client session, the administrative nature of the targeted workspace elevates the operational consequences. The injected script executes under the origin and session credentials of the active administrator.

The attacker can read, modify, or exfiltrate sensitive data, including CSRF tokens, session identifiers, and CMS settings. Because Silverstripe administrators have full write access to the underlying application database via the site tree and settings panels, the session context can be used to perform authorized actions. This includes the creation of backdoored administrator accounts, modifying site configurations, or injecting malicious scripts into public pages.

While the scope is classified as Unchanged because the execution is confined to the client browser, the administrative privileges of the compromised user effectively grant the attacker complete logical control over the CMS content. No active exploitation has been registered in the wild, but the existence of explicit regression tests in the codebase demonstrates a straightforward exploitation path.

The primary remediation for this vulnerability is upgrading the silverstripe/versioned package to version 3.2.1 or newer. This update ensures that all parameters processed by RestoreAction::getRestoreMessage are securely escaped prior to HTML assembly.

composer update silverstripe/versioned

If immediate package upgrade is not feasible, organizations can manually apply the hotfix by modifying src/RestoreAction.php. The modification requires wrapping all dynamic user-controlled strings, including $restoredItem->Title, $restoredItem->URLSegment, and $editLink, inside calls to the Convert::raw2xml helper.

To detect potential exploitation attempts or pre-existing payloads, security teams should execute database queries across historical version tables. The query targets instances of common HTML tags and attributes inside the Title and URLSegment columns:

SELECT ID, Title, URLSegment FROM "SiteTree_Versions" 
WHERE Title LIKE '%<script%' OR Title LIKE '%<iframe%' OR Title LIKE '%formaction%';