{"action":"Upgrade silverstripe/userforms to 6.4.9 or later.","affected":[{"fixed":"6.4.9","introduced":"0"},{"fixed":"7.0.7","introduced":"7.0.0"},{"fixed":"7.1.1","introduced":"7.1.0"}],"component":"silverstripe/userforms","cve_ids":["CVE-2026-54721"],"ecosystem":"Packagist","epss":0.00733,"exploited":false,"fixed_versions":["6.4.9","7.0.7","7.1.1"],"ghsa_id":"GHSA-g8wr-r2v2-vqc6","id":"tcs_01M5KF2H6NHVN6Q13X6XSK1929","modified_at":"2026-08-27T17:10:36.914600Z","published_at":"2026-08-27T16:53:17Z","references":["https://osv.dev/vulnerability/GHSA-g8wr-r2v2-vqc6","https://github.com/silverstripe/silverstripe-userforms/security/advisories/GHSA-g8wr-r2v2-vqc6","https://github.com/silverstripe/silverstripe-userforms/pull/1441","https://github.com/silverstripe/silverstripe-userforms/pull/1442","https://github.com/silverstripe/silverstripe-userforms/commit/23c069866900c19b499bfa997d1e251e97491702","https://github.com/silverstripe/silverstripe-userforms/commit/c55494ad7c717b199a3c1663b43a54db5d95604c","https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/userforms/CVE-2026-54721.yaml","https://github.com/silverstripe/silverstripe-userforms","https://github.com/silverstripe/silverstripe-userforms/releases/tag/6.4.9","https://github.com/silverstripe/silverstripe-userforms/releases/tag/7.0.7","https://github.com/silverstripe/silverstripe-userforms/releases/tag/7.1.1","https://www.silverstripe.org/download/security-releases/cve-2026-54721"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-g8wr-r2v2-vqc6","url":"https://osv.dev/vulnerability/GHSA-g8wr-r2v2-vqc6"}],"summary":"silverstripe/userforms vulnerable to remote code execution via userforms email subject"}