CVE-2026-54721

Silverstripe UserForms, the visual form-builder module for Silverstripe CMS, mishandles the subject field of email recipients configured in the CMS, allowing a specially crafted value in that field to be interpreted as executable server-side code (CWE-94). An authenticated CMS user who holds permission to configure a UserForms email recipient can supply the crafted payload in the subject field, causing arbitrary code to run on the web server. Successful exploitation yields server-side code execution that compromises the confidentiality, integrity, and availability of the affected site, reflected in the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N). All UserForms deployments from 6.0.0 before 6.4.9, 7.0.x before 7.0.7, and 7.1.x before 7.1.1 are affected. No public proof-of-concept or in-the-wild exploitation is currently known: the issue is not in CISA KEV, and EPSS assigns roughly a 0.4 percent probability of exploitation within 30 days.

What to do: Upgrade the UserForms module to 6.4.9 (6.x branch), 7.0.7 (7.0 branch), or 7.1.1 (7.1 branch), matching your installed major version. Until patched, limit CMS accounts with permission to edit UserForms email recipients and review existing email-recipient subject fields for unexpected content, since a planted payload would execute server-side. Because exploitation requires authenticated CMS access, apply least privilege and audit accounts that can manage form recipients.