Packagist/dnadesign/silverstripe-elemental CVE-2025-25197: medium 5.4, EPSS 0.31%

Silverstripe cross-site scripting (XSS) attack in elemental "Content blocks in use" report

Action: Upgrade dnadesign/silverstripe-elemental to 5.3.12 or later.

composer require dnadesign/silverstripe-elemental:5.3.12

Affected

Fixed versions

Sources

• osv: GHSA-x8xm-c7p8-2pj2
• https://github.com/silverstripe/silverstripe-elemental/security/advisories/GHSA-x8xm-c7p8-2pj2
• https://nvd.nist.gov/vuln/detail/CVE-2025-25197
• https://github.com/silverstripe/silverstripe-elemental/pull/1345
• https://github.com/silverstripe/silverstripe-elemental/commit/34ff4ed498ccab94cc5f55ef9a56c37f491eda1d
• https://github.com/FriendsOfPHP/security-advisories/blob/master/dnadesign/silverstripe-elemental/CVE-2025-25197.yaml
• https://github.com/silverstripe/silverstripe-elemental
• https://www.silverstripe.org/download/security-releases/cve-2025-25197

CVE-2025-25197 · published 2025-04-10T13:38:53Z · modified 2025-04-10T23:14:13.484639Z · JSON