PT-2024-21399 · Kirby Cms+1 · Kirby Cms+1

Published 2024-02-21 · Updated 2025-08-21 · CVE-2024-26482

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kirby CMS version 4.1.0

Description An HTML injection issue exists in the Edit Content Layout module. The vendor disputes the significance of this report, stating that some HTML formatting is allowed and backend sanitization prevents the injection of malicious scripts. However, it is reported that this could allow attackers to execute arbitrary code via a crafted payload.

Recommendations For Kirby CMS version 4.1.0, consider disabling the Edit Content Layout module until further guidance is available from the vendor, as a temporary workaround to minimize potential risks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2024-26482

GHSA-QV4X-V2V4-F8P9

SUSE-SU-2024:2571-1

Affected Products

Kirby Cms

Suse

References · 606

• 🔥 https://shrouded-trowel-50c.notion.site/Kirby-CMS-4-1-0-HTML-Injection-19ca19686d0a4533ab4b0c53fc977eef?pvs=4 · Exploit
• https://osv.dev/vulnerability/GHSA-qv4x-v2v4-f8p9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26482 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:2571-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-26482 · Vendor Advisory
• https://github.com/getkirby/kirby · Note
• https://bugzilla.suse.com/1226637 · Note
• https://suse.com/security/cve/CVE-2023-52812 · Note
• https://bugzilla.suse.com/1226891 · Note
• https://bugzilla.suse.com/1225585 · Note
• https://bugzilla.suse.com/1224949 · Note
• https://suse.com/security/cve/CVE-2023-52803 · Note
• https://suse.com/security/cve/CVE-2024-36945 · Note
• https://bugzilla.suse.com/1224584 · Note
• https://suse.com/security/cve/CVE-2023-52832 · Note