PT-2025-47416 · Kirby · Kirby

Published 2025-11-18 · Updated 2025-11-19 · CVE-2025-65012

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kirby versions 5.0.0 through 5.1.3

Description Kirby is a content management system. Attackers could modify the title of any page or the name of any user to a malicious string. Subsequently, they could alter any content field of the same model without saving, potentially causing the model to appear in the "Changes" dialog. If another authenticated user opens this dialog, malicious code could be executed. The attack requires interaction from another authenticated Panel user and cannot be automated. This issue impacts all Kirby 5 sites with potential attackers among authenticated Panel users or those allowing external visitors to update page titles or usernames. The vulnerability involves cross-site scripting (XSS), enabling the execution of JavaScript code within a Panel session, potentially allowing attackers to trigger requests to Kirby's API with the victim's permissions and escalate privileges.

Recommendations Update to Kirby version 5.1.4 or a later version.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-65012

GHSA-84HF-8GH5-575J

Affected Products

Kirby

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65012.json · Exploit
• https://github.com/getkirby/kirby/security/advisories/GHSA-84hf-8gh5-575j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65012 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65012 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-84hf-8gh5-575j · Vendor Advisory
• https://github.com/getkirby/kirby · Note
• https://github.com/getkirby/kirby/releases/tag/5.1.4 · Note
• https://twitter.com/VulmonFeeds/status/1990966651726987722 · Twitter Post
• https://twitter.com/CVEnew/status/1991042934297276530 · Twitter Post
• https://t.me/CVEtracker/37687 · Telegram Post