CVE-2010-5187: Silverstripe

Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days.

SilverStripe 2.3.x before 2.3.8 and 2.4.x before 2.4.1, when running on servers with certain configurations, allows remote attackers to obtain sensitive information via a direct request to PHP files in the (1) sapphire, (2) cms, or (3) mysite folders, which reveals the installation path in an error message.

Affected products

• Silverstripe Silverstripe: version 2.3.0 only; version 2.3.1 only; version 2.3.2 only; version 2.3.3 only; version 2.3.4 only; version 2.3.5 only; …

Published 2012-08-26. Last modified 2026-06-16.