Presentation
Silverstripe CMS is an open-source PHP content management system developed by Silverstripe Ltd. Its official Userforms module, silverstripe/userforms, lets CMS authors build public forms from the back office by adding fields and setting their titles. A configuration option, UserDefinedForm.required_identifier, appends a marker such as * to the label of every required field.
HDW Sec found that when this marker is configured, the author-controlled field title was concatenated with it and cast to raw HTML, so any markup in the title was rendered unescaped on the public form and executed for every visitor.
Issue(s)
EditableFormField::updateFormField()(code/Model/EditableFormField.php) builds the label of a required field as the field title followed by a<span class='required-identifier'>element, then passes the whole string throughDBField::create_field('HTMLText', ...). A form field title is normally escaped when rendered; this branch re-casts it toDBHTMLText, so the title is emitted raw.- Reproduced live on a self-hosted lab running
silverstripe/userforms7.1.1 withrequired_identifierset to*: a required text field whose title is<img src=x onerror=...>produces a front-end field whose title is aDBHTMLTextrendered without escaping, and the payload fires on the published form. - The script runs for anonymous visitors of the form and for any administrator who opens it, which crosses the author to visitor and author to administrator trust boundary.
- The vulnerable branch only runs when
required_identifieris configured, which is not the default. Sites that display a required-field marker, a common accessibility choice, are affected. - Affected versions:
silverstripe/userformsbefore 7.1.4. The vendor rated the issue medium, 4.4.
References
- Vendor advisory: SS-2026-005, published 2026-10-28.
- No CVE yet: Silverstripe published under its own identifier while CVE assignment is pending, and has requested one.
- Fixed in
silverstripe/userforms7.1.4.