Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/silverstripe/secureassets@3.0.0
purl pkg:composer/silverstripe/secureassets@3.0.0
Tags Ghost
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk 3.1
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-414d-7bfm-kud7
Aliases:
CVE-2021-28661
GHSA-r7rh-g777-g5gx
Incorrect Authorization Default SilverStripe GraphQL Server (aka silverstripe/graphql) permission checker is not inherited by query subclass.
3.5.2
Affected by 0 other vulnerabilities.
VCID-4x32-t75c-u3bj
Aliases:
CVE-2022-37421
GHSA-pp74-g2q5-j4jf
GMS-2022-6855
Silverstipe CMS Stored XSS in custom meta tags A malicious content author could create a custom meta tag and execute an arbitrary JavaScript payload. This would require convincing a legitimate user to access a page and enter a custom keyboard shortcut. This requires CMS access to exploit. There are no reported fixed by versions.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-03T21:28:26.340282+00:00 GitLab Importer Affected by VCID-4x32-t75c-u3bj https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/silverstripe/secureassets/CVE-2022-37421.yml 38.1.0
2026-04-01T12:48:54.467247+00:00 GitLab Importer Affected by VCID-414d-7bfm-kud7 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/silverstripe/secureassets/CVE-2021-28661.yml 38.0.0