Sign in
Deutsch English Español Polski
High

Cross-site scripting (XSS) from field and configuration text displayed in the Panel

  • Disclosed: 02.07.2021
  • Updated: 11.10.2026 10:22

On Saturday, @hdodov reported that the Panel's ListItem component (used in the pages and files section for example) displayed HTML in page titles as it is. This could be used for cross-site scripting (XSS) attacks.

We used his report as an opportunity to find and fix XSS issues related to dynamic site content throughout the Panel codebase.

Impact

Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the Panel session of other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim.

Such vulnerabilities are critical if you might have potential attackers in your group of authenticated Panel users. They can escalate their privileges if they get access to the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible.

Visitors without Panel access can only use this attack vector if your site allows changing site data from a frontend form (for example user self-registration or the creation of pages from a contact or other frontend form). If you validate or sanitize the provided form data, you are already protected against such attacks by external visitors.

Patches

Kirby 3.5.7 contains patches for the following issues we found during our investigation:

  • Some translated error and info messages contain placeholders to dynamically insert information like page titles or filenames. While the translation strings are allowed to contain HTML formatting, the dynamic data needs to be protected against XSS attacks. Kirby 3.5.7 now escapes the dynamic data.
  • Our Box component used to display information for the user supports HTML output for specific use-cases. We found out that the dialogs used in the files, pages and users fields as well as the fields section used it to display raw exception or error messages. These messages are now escaped.
  • The users and settings views display user and language data using the ListItem component that supports HTML. We now escape the dynamic data before it is passed to the ListItem component.
  • Some of our sections and fields support HTML for their text, help and/or info properties. This allows custom formatting from the blueprint, but also caused the original issue reported to us that allowed to inject HTML code from the content itself. Kirby 3.5.7 now escapes the default text displayed by the files and pages sections (filename/page title), the files, pages and users fields (filename/page title/username) and by query-based checkboxes, radio, tags and multiselect fields (default text depending on the used query).

Note: Custom text, help and info queries in blueprints are not escaped in 3.5.7. We support HTML in these properties because there are valid use-cases for custom formatting. However there can still be XSS vulnerabilities depending on your use of these properties. In Kirby 3.6 we will provide a new feature that will make it much easier to control whether you want to allow HTML from query placeholders.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package getkirby/cms < 3.5.7 3.5.7

References

CVSS score 7.1/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weakness (CWE)
CWE-80
Platform
Composer
Package
getkirby/cms
Disclosed
02.07.2021
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-2f2w-349x-vrqm - CC BY 4.0

Vulnerability history: getkirby/cms

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (51) in the archive
Total entries
51
First → latest
12.2020 09.2026
Without a fix
2
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 19
  • Medium 30
  • Low 1

Disclosures per year

Severity:
  1. Kirby: File upload permissions are not checked during processing of chunk data
    High CVE-2026-71415 >= 5.0.0, < 5.5.2 5.5.2
  2. Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling
    High CVE-2026-75594 < 4.9.5, >= 5.0.0, < 5.5.2 4.9.5, 5.5.2
  3. Kirby: `pages.access` permission is not checked in the `site/find` REST API route
    High CVE-2026-54005 < 4.9.4, >= 5.0.0-alpha.1, < 5.4.4 4.9.4, 5.4.4
  4. Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
    Critical CVE-2026-54003 < 4.9.4, >= 5.0.0-alpha.1, < 5.4.4 4.9.4, 5.4.4
  5. Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`
    High CVE-2026-54002 < 4.9.4, >= 5.0.0-alpha.1, < 5.4.4 4.9.4, 5.4.4
  6. Kirby: Self cross-site scripting (self-XSS) in the writer field
    High CVE-2026-49276 < 4.9.4, >= 5.0.0-alpha.1, < 5.4.4 4.9.4, 5.4.4
  7. Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend
    High CVE-2026-45368 < 4.9.1, >= 5.0.0, < 5.4.1 4.9.1, 5.4.1
  8. Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup
    High CVE-2026-44177 >= 5.3.0, < 5.4.1 5.4.1
  9. Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontend
    High CVE-2026-44175 < 4.9.1, >= 5.0.0, < 5.4.1 4.9.1, 5.4.1
  10. Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints
    High CVE-2026-44174 < 4.9.1, >= 5.0.0, < 5.4.1 4.9.1, 5.4.1
  11. Kirby CMS's read access to site, user and role information is not gated by permissions
    High CVE-2026-42069 < 4.9.0, >= 5.0.0, < 5.4.0 4.9.0, 5.4.0
  12. Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API
    High CVE-2026-42137 < 4.9.0, >= 5.0.0, < 5.4.0 4.9.0, 5.4.0
  13. Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection
    High CVE-2026-41325 < 4.9.0, >= 5.0.0, < 5.4.0 4.9.0, 5.4.0
  14. Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
    High · 8.1 CVE-2026-34587 < 4.9.0, >= 5.0.0, < 5.4.0 4.9.0, 5.4.0
  15. Kirby has insufficient permission checks in the language settings
    High · 8.1 CVE-2024-41964 < 3.6.6.6, >= 3.7.0, < 3.7.5.5, >= 3.8.0, < 3.8.4.4, >= 3.9.0, < 3.9.8.2, >= 3.10.0, < 3.10.1.1, >= 4.0.0, < 4.3.1 3.6.6.6, 3.7.5.5, 3.8.4.4, 3.9.8.2, 3.10.1.1, 4.3.1
  16. Field injection in the KirbyData text storage handler
    High · 7.1 CVE-2023-38488 < 3.5.8.3, >= 3.6.0, < 3.6.6.3, >= 3.7.0, < 3.7.5.2, >= 3.8.0, < 3.8.4.1, >= 3.9.0, < 3.9.6 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, 3.9.6
  17. Insufficient Session Expiration after a password change
    High · 7.3 CVE-2023-38489 < 3.5.8.3, >= 3.6.0, < 3.6.6.3, >= 3.7.0, < 3.7.5.2, >= 3.8.0, < 3.8.4.1, >= 3.9.0, < 3.9.6 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, 3.9.6
  18. Cross-site scripting from content entered in the tags and multiselect fields
    High · 7.1 ghsa-rv3r-vqjj-8c76 >= 3.5.7, < 3.5.8.1, >= 3.6.0, < 3.6.6.1, >= 3.7.0, < 3.7.4 3.5.8.1, 3.6.6.1, 3.7.4
  19. Cross-site scripting (XSS) from field and configuration text displayed in the Panel this entry
    High · 7.1 CVE-2021-32735 < 3.5.7 3.5.7
  20. Cross-site scripting (XSS) from unsanitized uploaded SVG files in Kirby
    High · 7.6 CVE-2021-29460 < 3.5.4 3.5.4

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.