Silverstripe CMS: Incomplete Sanitisation of SVG Data URIs leading to Stored Cross-Site Scripting

Presentation

Silverstripe CMS is an open-source PHP content management system developed by Silverstripe Ltd. Its framework ships XssSanitiser, the server-side filter applied to author-supplied HTML before it is stored and served. Part of that filter’s job is to remove data URIs able to carry script, a hardening introduced when CVE-2024-32981 was fixed.

HDW Sec found that the sanitiser still let data:image/svg+xml URIs through untouched. An SVG document can carry script, so a CMS author could store content that runs JavaScript in the browser of another user who views it.

Issue(s)

• XssSanitiser (src/Core/XssSanitiser.php) neutralises several dangerous URI schemes and media types, but did not treat data:image/svg+xml as script-capable: the value survived sanitiseString() unmodified, attribute and all.
• Reproduced live on a self-hosted Silverstripe 6.2.2 lab by calling the real XssSanitiser::sanitiseString() on <img src="data:image/svg+xml;base64,...">. The sanitiser returned the input unchanged, the base64 payload decoding to <svg onload=alert(1)>.
• Reported as an incomplete fix of CVE-2024-32981: the remediation of that advisory was meant to strip dangerous data URIs, and this media type was not covered. Silverstripe published a sibling advisory for XHTML and XML data URIs (CVE-2026-88987) in the same release.
• One honest limitation, carried in the report: an SVG data URI in an <img src> attribute does not by itself execute script in the image context. The defect is that the sanitiser, whose role after CVE-2024-32981 is to remove script-capable data URIs, let this one survive; execution depends on the context where the sanitised value is later consumed, such as an anchor target, an iframe or object source, or reuse of the attribute value elsewhere.
• Affected versions: silverstripe/framework before 6.2.13. The vendor rated the issue medium, 5.4.

References

• Vendor advisory: CVE-2026-88988, published 2026-10-28.
• GitHub advisory: GHSA-xwg4-8hqh-79jq.
• Original, incompletely fixed advisory: CVE-2024-32981.
• Fixed in silverstripe/framework 6.2.13.