Dapatrese

**Name of the Vulnerable Software and Affected Versions** Kirby versions prior to 4.9.0 Kirby versions prior to 5.4.0 **Description** The `Xml::value()` method in Kirby contains a flaw in how it handles `<![CDATA[ ]]>` blocks. While the method is designed to allow valid `CDATA` to pass through without being escaped a second time, it was possible to provide input that contained a valid `CDATA` block alongside other structured data. This allowed the structured data to bypass value protection, potentially leading to XML injection. XML injection is an attack where special characters are injected into input data to generate XML output with malicious meaning, which can manipulate the behavior of systems that parse the resulting XML schema. This issue affects the `Xml::value()` method, as well as `Xml::tag()`, `Xml::create()`, and the `Xml` data handler (e.g., `Data::encode($string, 'xml')`). These components are not used in the Kirby core but may be utilized in site or plugin code to create XML strings from input data. **Recommendations** Update to version 4.9.0 or later. Update to version 5.4.0 or later. As a temporary workaround, restrict or avoid using the `Xml::value()`, `Xml::tag()`, `Xml::create()` functions and the `Xml` data handler in site or plugin code if they process attacker-controlled input.

**Name of the Vulnerable Software and Affected Versions** Kirby versions prior to 3.5.8.3 Kirby versions prior to 3.6.6.3 Kirby versions prior to 3.7.5.2 Kirby versions prior to 3.8.4.1 Kirby versions prior to 3.9.6 **Description** A field injection vulnerability in Kirby's content storage implementation allows attackers with content write access to overwrite content fields that the site developer didn't intend to be modified. This can be used to alter site content, break site behavior, or inject malicious data or code. The exact security risk depends on the field type and usage. Kirby stores content in text files using the KirbyData format, where each field is separated by newlines and a line with four dashes (`----`). The vulnerability can be exploited by including a Unicode BOM sequence in a field separator, which can be abused to inject other field data into content files. **Recommendations** Update to Kirby version 3.5.8.3 or later to fix the vulnerability. Update to Kirby version 3.6.6.3 or later to fix the vulnerability. Update to Kirby version 3.7.5.2 or later to fix the vulnerability. Update to Kirby version 3.8.4.1 or later to fix the vulnerability. Update to Kirby version 3.9.6 or later to fix the vulnerability.

**Name of the Vulnerable Software and Affected Versions** Kirby versions prior to 3.5.8.3 Kirby versions prior to 3.6.6.3 Kirby versions prior to 3.7.5.2 Kirby versions prior to 3.8.4.1 Kirby versions prior to 3.9.6 **Description** The issue affects Kirby sites that use the `Xml` data handler or the `Xml::parse()` method in site or plugin code. XML External Entities (XXE) is a feature in the XML markup language that allows including data from external files in an XML structure. If the name of the external file can be controlled by an attacker, this becomes a vulnerability that can be abused for various system impacts like the disclosure of internal or confidential data stored on the server or to perform network requests on behalf of the server. The `Xml::parse()` method used PHP's `LIBXML NOENT` constant, which enabled the processing of XML external entities during the parsing operation. This method is used in the `Xml` data handler. Both the vulnerable method and the data handler are not used in the Kirby core but may be used in site or plugin code to parse RSS feeds or other XML files. If those files are of an external origin, attackers may be able to include an external entity in the XML file that will then be processed in the parsing process. **Recommendations** Update to Kirby version 3.5.8.3 or later to fix the vulnerability. Update to Kirby version 3.6.6.3 or later to fix the vulnerability. Update to Kirby version 3.7.5.2 or later to fix the vulnerability. Update to Kirby version 3.8.4.1 or later to fix the vulnerability. Update to Kirby version 3.9.6 or later to fix the vulnerability. As a temporary workaround, consider disabling the `Xml::parse()` method or restricting the use of the `Xml` data handler until a patch is available. Avoid using the `Xml` data handler or the `Xml::parse()` method with XML input controlled by an attacker.