silverstripe/assets
Composer · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| Silverstripe Assets Module has a DBFile::getURL() permission bypass | silverstripe/assets | Composer | Medium | Fix reported | |
| Silverstripe XSS in shortcodes | silverstripe/assetssilverstripe/framework | Composer | Medium | Fix reported | |
| SilverStripe Folders migrated from 3.x may be unsafe to upload to | silverstripe/assetssilverstripe/framework | Composer | High | Fix reported | |
| Unpublished, protected files can be published via shortcode | silverstripe/assets | Composer | Medium | Fix reported | |
| XSS via uploaded gpx file | silverstripe/assets | Composer | Medium | Fix reported | |
| Lack of access control on upoaded files | silverstripe/assetssilverstripe/framework | Composer | Medium | Fix reported | |
| SS-2026-003 - RCE via renamed uploaded file | silverstripe/assets | Composer | Unknown | No fix reported |