CVE-2026-55779

Name of the Vulnerable Software and Affected Versions Silverstripe Versioned versions prior to 3.2.1

Description In the RestoreAction::getRestoreMessage() function within src/RestoreAction.php, restore notifications in ArchiveAdmin are rendered as CAST HTML. The system fails to apply Convert::raw2xml() to the $restoredItem->Title, $restoredItem->URLSegment, $restoredItem->CMSEditLink(), and $changedProperty['value'] variables. This allows an administrator to execute stored JavaScript in their browser when restoring an archived page that contains a crafted title or URL segment, which can compromise the confidentiality and integrity of the CMS session.

Recommendations Update to version 3.2.1.