Sign in
Deutsch English Español Polski
Medium

Kirby XSS Vulnerability

  • Disclosed: 14.05.2022
  • Updated: 11.10.2026 10:22

A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package getkirby/cms < 2.3.3, >= 2.4, < 2.4.2, >= 2.5, < 2.5.7 2.3.3, 2.4.2, 2.5.7

References

CVSS score 5.4/10
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE)
CWE-79
Platform
Composer
Package
getkirby/cms
Disclosed
14.05.2022
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-275c-v3rc-xghx - CC BY 4.0

Vulnerability history: getkirby/cms

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (51) in the archive
Total entries
51
First → latest
12.2020 09.2026
Without a fix
2
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 19
  • Medium 30
  • Low 1

Disclosures per year

Severity:
  1. Kirby: File upload permissions are not checked during processing of chunk data
    High CVE-2026-71415 >= 5.0.0, < 5.5.2 5.5.2
  2. Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling
    High CVE-2026-75594 < 4.9.5, >= 5.0.0, < 5.5.2 4.9.5, 5.5.2
  3. Kirby: `pages.access` permission is not checked in the `site/find` REST API route
    High CVE-2026-54005 < 4.9.4, >= 5.0.0-alpha.1, < 5.4.4 4.9.4, 5.4.4
  4. Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
    Critical CVE-2026-54003 < 4.9.4, >= 5.0.0-alpha.1, < 5.4.4 4.9.4, 5.4.4
  5. Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`
    High CVE-2026-54002 < 4.9.4, >= 5.0.0-alpha.1, < 5.4.4 4.9.4, 5.4.4
  6. Kirby: Self cross-site scripting (self-XSS) in the writer field
    High CVE-2026-49276 < 4.9.4, >= 5.0.0-alpha.1, < 5.4.4 4.9.4, 5.4.4
  7. Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend
    High CVE-2026-45368 < 4.9.1, >= 5.0.0, < 5.4.1 4.9.1, 5.4.1
  8. Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup
    High CVE-2026-44177 >= 5.3.0, < 5.4.1 5.4.1
  9. Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontend
    High CVE-2026-44175 < 4.9.1, >= 5.0.0, < 5.4.1 4.9.1, 5.4.1
  10. Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints
    High CVE-2026-44174 < 4.9.1, >= 5.0.0, < 5.4.1 4.9.1, 5.4.1
  11. Kirby CMS's read access to site, user and role information is not gated by permissions
    High CVE-2026-42069 < 4.9.0, >= 5.0.0, < 5.4.0 4.9.0, 5.4.0
  12. Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API
    High CVE-2026-42137 < 4.9.0, >= 5.0.0, < 5.4.0 4.9.0, 5.4.0
  13. Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection
    High CVE-2026-41325 < 4.9.0, >= 5.0.0, < 5.4.0 4.9.0, 5.4.0
  14. Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
    High · 8.1 CVE-2026-34587 < 4.9.0, >= 5.0.0, < 5.4.0 4.9.0, 5.4.0
  15. Kirby has insufficient permission checks in the language settings
    High · 8.1 CVE-2024-41964 < 3.6.6.6, >= 3.7.0, < 3.7.5.5, >= 3.8.0, < 3.8.4.4, >= 3.9.0, < 3.9.8.2, >= 3.10.0, < 3.10.1.1, >= 4.0.0, < 4.3.1 3.6.6.6, 3.7.5.5, 3.8.4.4, 3.9.8.2, 3.10.1.1, 4.3.1
  16. Field injection in the KirbyData text storage handler
    High · 7.1 CVE-2023-38488 < 3.5.8.3, >= 3.6.0, < 3.6.6.3, >= 3.7.0, < 3.7.5.2, >= 3.8.0, < 3.8.4.1, >= 3.9.0, < 3.9.6 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, 3.9.6
  17. Insufficient Session Expiration after a password change
    High · 7.3 CVE-2023-38489 < 3.5.8.3, >= 3.6.0, < 3.6.6.3, >= 3.7.0, < 3.7.5.2, >= 3.8.0, < 3.8.4.1, >= 3.9.0, < 3.9.6 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, 3.9.6
  18. Cross-site scripting from content entered in the tags and multiselect fields
    High · 7.1 ghsa-rv3r-vqjj-8c76 >= 3.5.7, < 3.5.8.1, >= 3.6.0, < 3.6.6.1, >= 3.7.0, < 3.7.4 3.5.8.1, 3.6.6.1, 3.7.4
  19. Kirby XSS Vulnerability this entry
    Medium · 5.4 CVE-2017-16807 < 2.3.3, >= 2.4, < 2.4.2, >= 2.5, < 2.5.7 2.3.3, 2.4.2, 2.5.7
  20. Cross-site scripting (XSS) from field and configuration text displayed in the Panel
    High · 7.1 CVE-2021-32735 < 3.5.7 3.5.7
  21. Cross-site scripting (XSS) from unsanitized uploaded SVG files in Kirby
    High · 7.6 CVE-2021-29460 < 3.5.4 3.5.4

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.