In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation.
{ "cpes": [ "cpe:2.3:a:silverstripe:silverstripe:*:*:*:*:*:*:*:*", "cpe:2.3:a:silverstripe:silverstripe:4.6.0:rc1:*:*:*:*:*:*" ], "severity": "Medium" }