The vulnerability originates in Silverstripe Versioned's restore logic. The RestoreAction::getRestoreMessage() method builds an archived page restoration notification as CAST_HTML and injects values from $restoredItem->Title, $restoredItem->URLSegment, $restoredItem->CMSEditLink(), and $changedProperty['value'] without sanitizing them. If an administrator restores an archived page whose title or URL segment contains malicious JavaScript, the confirmation message executed in the admin browser allows the attacker to run arbitrary code, gaining access to the CMS session.

The affected product is the Silverstripe Versioned module from Silverstripe. All deployments of the module older than version 3.2.1 are vulnerable. The module is a component of Silverstripe CMS that enables versioning for models.

The CVSS score is 5.4, indicating moderate severity. EPSS information is unavailable, but the vulnerability requires administrative interaction to trigger the exploit—an admin must restore a page containing crafted input. Without such interaction the path is not remotely exploitable. This entry is not listed in the CISA KEV catalog. Attackers can exploit the flaw by creating an archived page with malicious content and then prompting an authorized administrator to restore it, leading to session hijacking and potential further actions on the CMS.