The flaw resides in the email recipient subject field of Silverstripe UserForms, where a specially crafted payload is interpreted as executable PHP code. This allows anyone with CMS edit rights over UserForms email recipients to run arbitrary server‑side code, effectively compromising confidentiality, integrity, and availability of the host. The weakness is a classic code injection error, classified as CWE‑94.

Silverstripe UserForms as supplied by the silverstripe vendor. Versions from 6.0.0 up to, but not including, 6.4.9; 7.0.0 up to, but not including, 7.0.7; and 7.1.0 up to, but not including, 7.1.1 are affected.

The vulnerability carries a CVSS score of 8.8, indicating high risk. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated CMS user who has permission to configure UserForms email recipients; the attacker crafts the subject field to inject PHP code, which is then executed on the server. Because the attack vector is limited to internal users with appropriate rights, the threat surface is constrained, but the impact of successful exploitation remains severe.