Articles Writeups CVE Programs

Sign in Start free

BUGFLARE

Threat intelligence and bug bounty research platform. Live vulnerability data, in-app writeup reading, and program tracking — aggregated from trusted public sources.

Explore

Articles Writeups CVE Programs Create account

Legal

© 2026 Bugflare. Publishers retain authorship; always verify on the source.

bugflare.site

silverstripe/versioned has XSS in archive admin restore · Bugflare

In-app reader

silverstripe/versioned has XSS in archive admin restore

GitHub AdvisoriesAugust 28, 2026Sign in to save

Sign in to like · 0

advisory github CVE-2026-55779 medium

Impact

It's possible to use the page title as an XSS vector when restoring a page in ArchiveAdmin

Reporter

Steve Boyd

Silverstripe Ltd.

References

GHSA-m4g4-86qc-v8w7
silverstripe/silverstripe-versioned#541
silverstripe/silverstripe-versioned@6e30a2c
https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/versioned/CVE-2026-55779.yaml
https://github.com/silverstripe/silverstripe-versioned/releases/tag/3.2.1
https://www.silverstripe.org/download/security-releases/cve-2026-55779

Source

Originally published by GitHub Advisories (github.com).

Shown in Bugflare for convenience. Ownership and accuracy remain with the original publisher — always verify on the source when it matters.

Open original on github.com →https://github.com/advisories/GHSA-m4g4-86qc-v8w7

Discussion

Comments

Sign in to join the discussion.

No comments yet — start the thread.

Keep reading

More on Bugflare

WriteupTryHackMe Theseus WalkthroughOriginal Bugflare path through Theseus: Flask Jinja SSTI on :8080, Labyrinth BOF, ariadne sudo for Minotaur, then JPEG repair + stego into Athens. Flags redacted; credentials omitted.
WriteupTryHackMe Crocc Crew WalkthroughOriginal Bugflare AD path through Crocc Crew: Visitor SMB, planted admCroccCrew, Kerberoast password-reset, constrained delegation with -altservice to DA. Flags and passwords redacted.
WriteupTryHackMe Stealth WalkthroughOriginal Bugflare path through Stealth: AV-aware .ps1 reverse shell on :8080, wipe the upload log for the user flag, then hijack MyTHMTask's writable binary for admin. Flags redacted.
WriteupTryHackMe TryHack3M Subscribe WalkthroughOriginal Bugflare path through TryHack3M: Subscribe — Host/Referer invite leak, VIP cookie, admin SQLi, then Splunk reconstruction. Secrets redacted.
WriteupTryHackMe AVenger Walkthrough

Original Bugflare path through AVenger: Forminator upload bot, Defender-evasive powercat foothold as hugo, then UAC bypass to Administrator. Flags redacted.

WriteupTryHackMe Dodge WalkthroughOriginal Bugflare path through Dodge: TLS SANs to a browser UFW panel, anonymous FTP for an SSH backup key, notes pivot to cobra, then sudo apt Pre-Invoke for root. Flags redacted.

Optional: create a free account to save items, track programs, and sync across web + app. Reading stays free.