Iniciar sesión
Deutsch English Español Polski
Media

Cross-site scripting (XSS) from image block content in the site frontend

  • Publicada: 16.11.2021
  • Actualizado: 11.10.2026 10:22

Impact

Kirby's blocks field stores structured data for each block. This data is then used in block snippets to convert the blocks to HTML for use in your templates. We recommend to escape HTML special characters against cross-site scripting (XSS) attacks.

Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the site frontend or Panel session of other users. If the user is logged in to the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim.

The default snippet for the image block unfortunately did not use our escaping helper. This made it possible to include malicious HTML code in the source, alt and link fields of the image block, which would then be displayed on the site frontend and executed in the browsers of site visitors and logged in users who are browsing the site.

This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users. They can escalate their privileges if they get access to the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible.

You are not affected if you don't use the blocks field or specifically the image block in any of your blueprints. You are also protected if you use a custom block snippet that either escapes the printed values or doesn't use them. The attack can only be performed by logged-in users and only surfaces in the site frontend (i.e. in your templates). The Panel itself is unaffected and will not execute JavaScript that was injected into the image block content.

Patches

We have patched the vulnerability in Kirby 3.5.8 by escaping special HTML characters in the output from the default image block snippet. Please update to this or a later version to fix the vulnerability.

Credits

Thanks to Azrul Ikhwan Zulkifli (@azrultech) from BAE Systems AI Vulnerability Research Team for responsibly reporting the identified issue.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Paquete de Composer getkirby/cms >= 3.5.0, < 3.5.8 3.5.8

Referencias

Puntuación CVSS 5.4/10
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Debilidad (CWE)
CWE-79, CWE-80
Plataforma
Composer
Paquete
getkirby/cms
Publicada
16.11.2021
Actualizado
11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-cq58-r77c-5jjw - CC BY 4.0

Historial de vulnerabilidades: getkirby/cms

Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (51) en el archivo
Entradas en total
51
Primera → última
12.2020 09.2026
Sin corrección
2
Explotada en ataques
0

Distribución por gravedad

  • Crítica 1
  • Alta 19
  • Media 30
  • Baja 1

Divulgaciones por año

Gravedad:
  1. Kirby: File upload permissions are not checked during processing of chunk data
    Alta CVE-2026-71415 >= 5.0.0, < 5.5.2 5.5.2
  2. Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling
    Alta CVE-2026-75594 < 4.9.5, >= 5.0.0, < 5.5.2 4.9.5, 5.5.2
  3. Kirby: `pages.access` permission is not checked in the `site/find` REST API route
    Alta CVE-2026-54005 < 4.9.4, >= 5.0.0-alpha.1, < 5.4.4 4.9.4, 5.4.4
  4. Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
    Crítica CVE-2026-54003 < 4.9.4, >= 5.0.0-alpha.1, < 5.4.4 4.9.4, 5.4.4
  5. Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`
    Alta CVE-2026-54002 < 4.9.4, >= 5.0.0-alpha.1, < 5.4.4 4.9.4, 5.4.4
  6. Kirby: Self cross-site scripting (self-XSS) in the writer field
    Alta CVE-2026-49276 < 4.9.4, >= 5.0.0-alpha.1, < 5.4.4 4.9.4, 5.4.4
  7. Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend
    Alta CVE-2026-45368 < 4.9.1, >= 5.0.0, < 5.4.1 4.9.1, 5.4.1
  8. Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup
    Alta CVE-2026-44177 >= 5.3.0, < 5.4.1 5.4.1
  9. Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontend
    Alta CVE-2026-44175 < 4.9.1, >= 5.0.0, < 5.4.1 4.9.1, 5.4.1
  10. Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints
    Alta CVE-2026-44174 < 4.9.1, >= 5.0.0, < 5.4.1 4.9.1, 5.4.1
  11. Kirby CMS's read access to site, user and role information is not gated by permissions
    Alta CVE-2026-42069 < 4.9.0, >= 5.0.0, < 5.4.0 4.9.0, 5.4.0
  12. Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API
    Alta CVE-2026-42137 < 4.9.0, >= 5.0.0, < 5.4.0 4.9.0, 5.4.0
  13. Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection
    Alta CVE-2026-41325 < 4.9.0, >= 5.0.0, < 5.4.0 4.9.0, 5.4.0
  14. Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
    Alta · 8.1 CVE-2026-34587 < 4.9.0, >= 5.0.0, < 5.4.0 4.9.0, 5.4.0
  15. Kirby has insufficient permission checks in the language settings
    Alta · 8.1 CVE-2024-41964 < 3.6.6.6, >= 3.7.0, < 3.7.5.5, >= 3.8.0, < 3.8.4.4, >= 3.9.0, < 3.9.8.2, >= 3.10.0, < 3.10.1.1, >= 4.0.0, < 4.3.1 3.6.6.6, 3.7.5.5, 3.8.4.4, 3.9.8.2, 3.10.1.1, 4.3.1
  16. Field injection in the KirbyData text storage handler
    Alta · 7.1 CVE-2023-38488 < 3.5.8.3, >= 3.6.0, < 3.6.6.3, >= 3.7.0, < 3.7.5.2, >= 3.8.0, < 3.8.4.1, >= 3.9.0, < 3.9.6 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, 3.9.6
  17. Insufficient Session Expiration after a password change
    Alta · 7.3 CVE-2023-38489 < 3.5.8.3, >= 3.6.0, < 3.6.6.3, >= 3.7.0, < 3.7.5.2, >= 3.8.0, < 3.8.4.1, >= 3.9.0, < 3.9.6 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, 3.9.6
  18. Cross-site scripting from content entered in the tags and multiselect fields
    Alta · 7.1 ghsa-rv3r-vqjj-8c76 >= 3.5.7, < 3.5.8.1, >= 3.6.0, < 3.6.6.1, >= 3.7.0, < 3.7.4 3.5.8.1, 3.6.6.1, 3.7.4
  19. Cross-site scripting (XSS) from image block content in the site frontend esta entrada
    Media · 5.4 CVE-2021-41258 >= 3.5.0, < 3.5.8 3.5.8
  20. Cross-site scripting (XSS) from field and configuration text displayed in the Panel
    Alta · 7.1 CVE-2021-32735 < 3.5.7 3.5.7
  21. Cross-site scripting (XSS) from unsanitized uploaded SVG files in Kirby
    Alta · 7.6 CVE-2021-29460 < 3.5.4 3.5.4

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.