Silverstripe Framework Cross-Site Scripting Vulnerability in Form Messages

A cross-site scripting (XSS) vulnerability has been identified in the Silverstripe Framework, specifically in versions prior to 5.3.8. This issue arises in certain scenarios where form messages can include user-provided content with HTML markup, such as links. In these cases, the content is not properly sanitized before being incorporated into the form messages, allowing for XSS attacks.

Impact

Exploitation of this vulnerability allows for cross-site scripting attacks, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users are advised to upgrade to Silverstripe Framework version 5.3.8 or later.