{"items":[{"id":"NVI-00006099","kind":"vulnerability","title":"Silverstripe HtmlEditor embed url sanitisation","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-qp29-wcc2-vmpc"],"plain_summary":"OSV carries this publisher advisory for silverstripe/framework. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 3.2.1 for silverstripe/framework. Confirm the publisher’s latest guidance.","source_ids":["sr-a739b7d50f2916237cde9b98b9685967"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-a739b7d50f2916237cde9b98b9685967","url":"https://github.com/advisories/GHSA-qp29-wcc2-vmpc","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-qp29-wcc2-vmpc","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:41.350Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-a739b7d50f2916237cde9b98b9685967"],"technology":"silverstripe/framework","known_exclusions":[],"conditions_summary":"\"Add from URL\" doesn't clearly sanitise URL server side\n\nHtmlEditorField_Toolbar has an action HtmlEditorField_Toolbar#viewfile, which gets called by the CMS when adding a media \"from a URL\" (i.e. via oembed).\n\nThis action gets the URL to add in the GET parameter FileURL. However it doesn't do any URL sanitising server side. The current logic will pass this through to Oembed, which will probably reject most dangerous URLs, but it's possible future changes would break this.","public_affected_ranges":["ECOSYSTEM: introduced 3.0.0; fixed 3.2.1"]}],"null_published_at":"2026-10-31T22:13:05.859Z","source_updated_at":"2024-11-28T05:41:00.784Z","source_disclosed_at":"2024-05-23T18:14:45.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:41.350Z"}],"next_cursor":null,"snapshot_revision":"42594"}