Description In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation. Remediation References CVE-2020-26138 Related Vulnerabilities WordPress Plugin Xerte Online 'save.php' Arbitrary File Upload (0.32) Atlassian Confluence CVE-2023-22503 Vulnerability (CVE-2023-22503) TYPO3 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2009-3634) WordPress Plugin WordPress Facebook SQL Injection (1.0.13) WordPress Plugin Leaky Paywall PHP Object Injection (4.9.1) Severity Medium Classification CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Tags Missing Update Known Vulnerabilities CWE-20 CVE-2020-26138