silverstripe/userforms vulnerable to remote code execution via userforms email subject

Impact

The userform email subject field in the CMS is vulnerable to a specially crafted payload being used to run arbitrary code on the server.

Reported by

Jack Wallace from Bastion Security

References

• GHSA-g8wr-r2v2-vqc6

• silverstripe/silverstripe-userforms#1441

• silverstripe/silverstripe-userforms#1442

• silverstripe/silverstripe-userforms@23c0698

• silverstripe/silverstripe-userforms@c55494a

• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/userforms/CVE-2026-54721.yaml

• https://github.com/silverstripe/silverstripe-userforms/releases/tag/6.4.9

• https://github.com/silverstripe/silverstripe-userforms/releases/tag/7.0.7

• https://github.com/silverstripe/silverstripe-userforms/releases/tag/7.1.1

• https://www.silverstripe.org/download/security-releases/cve-2026-54721