CVE-2026-88991 - RCE in email subject field via template execution

PKSA-kp8m-vvtz-69sm CVE-2026-88991

Affected package: silverstripe/userforms

Affected version: <6.4.10|>=7.0.0,<7.1.4

Reported by:
FriendsOfPHP/security-advisories