PT-2026-44155 · Packagist+2 · Getkirby/Cms+1
CVE-2026-45368
·
Published
2026-05-27
·
Updated
2026-07-16
CVSS v4.0
8.4
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Kirby versions prior to 4.9.1
Kirby versions prior to 5.4.1
Description
Kirby is an open-source content management system. A stored Cross-site scripting (XSS) issue exists where the system fails to filter malicious URL values that resolve to script execution. This occurs when content is authored by untrusted users who have update permissions for
textarea or blocks fields, or write access to content files. The issue affects four first-party renderers that produce <a href="…"> output: the (link: …) KirbyTag, the link: parameter of the (image: …) KirbyTag (when it does not resolve to a known file or self), the link field of the built-in image block, and the HTML importer for the blocks field. Additionally, the use of Html::a() or Html::link() with untrusted input is an attack vector.While simple
javascript: URLs were previously deactivated, attackers can bypass this protection using the format javascript://x%0A…. Other affected URI schemes include vbscript:, data:, livescript:, mocha:, and jar:. If a visitor clicks a malicious link rendered on the site frontend, the script executes in their browser, potentially allowing an attacker to take full control of a victim's Panel session.Recommendations
Update Kirby to version 4.9.1 or later.
Update Kirby to version 5.4.1 or later.
Restrict update permissions for
textarea and blocks fields to fully trusted users only.
Avoid using Html::a() or Html::link() with untrusted user input.Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Getkirby/Cms
Kirby