Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/silverstripe/assets@1.3.5
purl pkg:composer/silverstripe/assets@1.3.5
Next non-vulnerable version 2.4.5
Latest non-vulnerable version 3.1.3
Risk score 3.4
Vulnerabilities affecting this package (5)
Advisory Summary Fixed in package version
GHSA-vv3r-fxqp-vr3f
Aliases:
CVE-2022-38147
GMS-2022-6854
XSS via uploaded gpx file A malicious content author could upload a GPX file with a Javascript payload. The payload …
1.11.1
Vulnerable
GHSA-9cx2-hj6m-fv58
Aliases:
CVE-2022-38724
GMS-2022-6853
Silverstripe XSS in shortcodes A malicious content author could add arbitrary attributes to HTML editor shortcodes which could be used …
1.11.1
Vulnerable
GHSA-v68g-62v9-39w5
Aliases:
CVE-2022-29858
Unpublished, protected files can be published via shortcode Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows …
1.10.1
Vulnerable
GHSA-592m-4533-rxq9
Aliases:
CVE-2020-9280
SilverStripe Folders migrated from 3.x may be unsafe to upload to In SilverStripe through 4.5, files uploaded via Forms to …
1.4.7
Vulnerable
GHSA-jgcf-rf45-2f8v
Aliases:
CVE-2026-24749
Silverstripe Assets Module has a DBFile::getURL() permission bypass ### Impact Images rendered in templates or otherwise accessed via `DBFile::getURL()` or …
2.4.5
Not vulnerable
Vulnerabilities fixed by this package (1)

Advisory Summary Aliases
GHSA-jvx5-rm6q-gx7p
Lack of access control on upoaded files SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). … CVE-2019-12245