Silverstripe silverstripe/subsites up to and including 2.6.0 has Insecure Permissions.
silverstripe subsites