Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-7dk3-gcup-2kc9
Vulnerability ID VCID-7dk3-gcup-2kc9
Aliases CVE-2020-25817
GHSA-3vjc-5x79-m9r8
Summary SilverStripe XXE Vulnerability in CSSContentParser SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity (XXE) attacks. When this developer utility is misused for purposes involving external or user submitted data in custom project code, it can lead to vulnerabilities such as XSS on HTML output rendered through this custom code. This is now mitigated by disabling external entities during parsing. (The correct CVE ID year is 2020 [CVE-2020-25817, not CVE-2021-25817]).
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-611 Improper Restriction of XML External Entity Reference
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00348 https://api.first.org/data/v1/epss?cve=CVE-2020-25817
epss 0.00348 https://api.first.org/data/v1/epss?cve=CVE-2020-25817
epss 0.00348 https://api.first.org/data/v1/epss?cve=CVE-2020-25817
epss 0.00348 https://api.first.org/data/v1/epss?cve=CVE-2020-25817
epss 0.00348 https://api.first.org/data/v1/epss?cve=CVE-2020-25817
epss 0.00348 https://api.first.org/data/v1/epss?cve=CVE-2020-25817
epss 0.00348 https://api.first.org/data/v1/epss?cve=CVE-2020-25817
epss 0.00348 https://api.first.org/data/v1/epss?cve=CVE-2020-25817
epss 0.00348 https://api.first.org/data/v1/epss?cve=CVE-2020-25817
epss 0.00348 https://api.first.org/data/v1/epss?cve=CVE-2020-25817
cvssv3.1 4.8 https://forum.silverstripe.org/c/releases
generic_textual MODERATE https://forum.silverstripe.org/c/releases
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-3vjc-5x79-m9r8
cvssv3.1 4.8 https://github.com/silverstripe/silverstripe-framework
generic_textual MODERATE https://github.com/silverstripe/silverstripe-framework
cvssv3.1 4.8 https://nvd.nist.gov/vuln/detail/CVE-2020-25817
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2020-25817
cvssv3.1 4.8 https://www.silverstripe.org/blog/tag/release
generic_textual MODERATE https://www.silverstripe.org/blog/tag/release
cvssv3.1 4.8 https://www.silverstripe.org/download/security-releases
generic_textual MODERATE https://www.silverstripe.org/download/security-releases
cvssv3.1 4.8 https://www.silverstripe.org/download/security-releases/cve-2021-25817
generic_textual MODERATE https://www.silverstripe.org/download/security-releases/cve-2021-25817
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2020-25817
https://forum.silverstripe.org/c/releases
https://github.com/silverstripe/silverstripe-framework
https://nvd.nist.gov/vuln/detail/CVE-2020-25817
https://www.silverstripe.org/blog/tag/release
https://www.silverstripe.org/download/security-releases
https://www.silverstripe.org/download/security-releases/
https://www.silverstripe.org/download/security-releases/cve-2021-25817
GHSA-3vjc-5x79-m9r8 https://github.com/advisories/GHSA-3vjc-5x79-m9r8
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Found at https://forum.silverstripe.org/c/releases
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/silverstripe/silverstripe-framework
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2020-25817
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Found at https://www.silverstripe.org/blog/tag/release
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Found at https://www.silverstripe.org/download/security-releases
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Found at https://www.silverstripe.org/download/security-releases/cve-2021-25817
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.5728
EPSS Score 0.00348
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:11:59.893574+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-3vjc-5x79-m9r8/GHSA-3vjc-5x79-m9r8.json 38.0.0