CVE-2017-14498: SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option...

Security readout for executives and security teams

CVE-2017-14498 is a cross-site scripting issue in SilverStripe CMS before 3.6.1. The risk comes from SVG files being handled unsafely through CMS media insertion or admin asset upload paths. If abused, script content could run in a trusted site or CMS context. Public sources do not provide CVSS scoring or evidence of active exploitation. Exposure is most likely on SilverStripe CMS installations older than 3.6.1 that allow SVG uploads or media insertion through CMS/admin workflows. Risk depends on who can upload media and where uploaded SVG content is viewed or embedded. Treat this as a targeted remediation item for legacy SilverStripe sites, especially public-facing CMS environments. It is not sourced as actively exploited, but XSS in CMS media handling can affect administrative trust, site integrity, and visitor safety. Mitigation focus: Upgrade SilverStripe CMS/framework to 3.6.1 or later per vendor guidance.; Review vendor changelog and linked commits for required framework and installer changes.; Restrict SVG uploads until affected systems are upgraded or vendor mitigations are confirmed..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.