Skip to content

DOC Create June 2026 security release entry for CMS 6.3 changelog #894

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
blueo merged 1 commit into from
Aug 3, 2026
Merged

DOC Create June 2026 security release entry for CMS 6.3 changelog #894

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 32 additions & 1 deletion en/08_Changelogs/6.3.0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,37 @@ title: 6.3.0 (unreleased)

</details>

## Security considerations {#security-considerations}

This release includes several security fixes. Review the vulnerability disclosures below for more detailed descriptions of each security fix. We highly encourage upgrading your project to include the latest security patches.

We have provided a severity rating of each vulnerability below based on its CVSS score. The impact of each vulnerability could vary based on the specifics of each project. You can [read the severity rating definitions](/contributing/release_process/#severity-rating) in the Silverstripe CMS release process.

- [CVE-2026-54721 Remote code execution via userforms email subject](https://www.silverstripe.org/download/security-releases/cve-2026-54721) Severity: High
- [CVE-2026-54718 Remote code execution via advanced workflow email template](https://www.silverstripe.org/download/security-releases/cve-2026-54718) Severity: High
- [CVE-2026-54717 XSS in breadcrumbs in page listview](https://www.silverstripe.org/download/security-releases/cve-2026-54717) Severity: Medium
- [CVE-2026-54720 XSS attack through media embed](https://www.silverstripe.org/download/security-releases/cve-2026-54720) Severity: Medium
- [CVE-2026-55779 ArchiveAdmin XSS](https://www.silverstripe.org/download/security-releases/cve-2026-55779) Severity: Medium

The root-cause fix for both remote code execution vulnerabilities lives in the template parser, which now emits single-quoted PHP string literals for `<%t %>` translation blocks so that variables and expressions are no longer interpolated.

The high severity fixes have also been released in patches for the CMS 5.4, 6.1, and 6.2 release lines. The medium severity fixes have been released in a patch for the CMS 6.2 release line. That difference follows our [release policy](/project_governance/release_policy/#partial-support): a release line in *partial support* only receives fixes for high and critical impact vulnerabilities, meaning those with a CVSS score of 7.0 or above, while a release line in *full support* receives fixes at any severity. The [Silverstripe CMS security patches June 2026](https://www.silverstripe.org/blog/silverstripe-cms-security-patches-june-2026) blog post lists the same distribution.

### Action may be required for media embeds {#media-embed-sandboxing}

The fix for [CVE-2026-54720](https://www.silverstripe.org/download/security-releases/cve-2026-54720) now strips event-handler and other unsafe attributes from a non-sandboxed `<iframe>` returned by an oEmbed provider. If stripping an attribute breaks a legitimate embed, you can exempt a fully trusted provider's domain from sandboxing with the [`EmbedShortcodeProvider.domains_excluded_from_sandboxing`](api:SilverStripe\View\Shortcodes\EmbedShortcodeProvider->domains_excluded_from_sandboxing) configuration property:

```yml
# app/_config/embed.yml
SilverStripe\View\Shortcodes\EmbedShortcodeProvider:
domains_excluded_from_sandboxing:
- trusted-provider.com
```

The domain is matched by suffix, so the value above also matches subdomains such as `embed.trusted-provider.com` - and any other domain ending in the same string, including an unrelated `nottrusted-provider.com`. Give the full domain, so you don't match a domain you don't control.

Embeds from an excluded domain render exactly as the provider sends them, and are no longer wrapped in a sandboxed iframe, so only add domains you fully trust. See [sandboxing oembed HTML](/developer_guides/forms/field_types/htmleditorfield/#sandboxing-oembed-html) for more about how sandboxing works.

## Features and enhancements

### Other new features and enhancements {#other-new}
Expand All @@ -27,7 +58,7 @@ No other new features or enhancements have been documented yet for this release.

### React class components converted to functional components {#react-functional-components}

Form field components in the CMS have been converted from React class components to functional components. This is part of an ongoing modernisation effort — functional components are simpler, have better tooling support, and align with current React best practices.
Form field components in the CMS have been converted from React class components to functional components. This is part of an ongoing modernisation effort - functional components are simpler, have better tooling support, and align with current React best practices.
Comment thread
blueo marked this conversation as resolved.

For most projects this change is invisible. However, if your project extends any of these components as an ES6 class (`extends TextField`), that pattern will no longer work because functional components cannot be subclassed.

Expand Down
Loading