Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') Affecting silverstripe/framework package, versions <3.1.12
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-SILVERSTRIPEFRAMEWORK-17400360
- published22 Jun 2026
- disclosed19 Jun 2026
- creditJamie Totten
Introduced: 19 Jun 2026
New CVE NOT AVAILABLE CWE-776 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade silverstripe/framework to version 3.1.12 or higher.
Overview
silverstripe/framework is a PHP framework forming the base for the SilverStripe CMS.
Affected versions of this package are vulnerable to Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') via XML entity expansion. An attacker can cause denial of service by supplying specially crafted XML documents that trigger a Quadratic Blowup Attack, resulting in excessive CPU and memory consumption during XML parsing and degrading application performance.