EUVD-2026-42671
GHSA-rhj6-r49h-5932
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLearn target blueprint/content structure
-
DeliverySocial-engineer Panel editor to insert javascript: link
-
ExploitEditor clicks link before save
-
ExecutionScript runs in authenticated Panel session
-
PersistIssue Kirby API calls as victim
-
ImpactEscalate via admin session or store XSS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Attribute value escaping
|
| Exploitation Conditions | Exploitation requires the target Kirby site to use the writer field in a blueprint (or a Panel plugin embedding the <k-writer> component). The attacker must supply a link/email mark whose target is a javascript: scheme URL - for the email mark this cannot be done through the Panel UI due to email validation and must be injected via a side channel such as the browser console. A Panel user must then actively click the malicious link (UI:A) within the editing session before the content is saved, since the backend sanitizes the URL on save. Successful attacks commonly require the attacker's knowledge of the content structure plus social engineering of a user with Panel access, and the attack cannot be automated. Limiting factors: high attack complexity, mandatory user interaction, and Kirby's default configuration confining impact to self-XSS (no direct effect on other users/visitors) unless a plugin stores unsanitized <k-writer> HTML, which enables stored XSS. |
| Impact | The signals are internally consistent and point to a real but constrained risk rather than a mass-exploitation threat. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N, base 7.4) encodes high attack complexity and required active user interaction, matching the description's statement that exploitation needs attacker knowledge of the content structure, social engineering of a Panel user, and a click before save - and that the attack cannot be automated. No EPSS score, SSVC decision, KEV entry, or public POC is present in the provided data, so no automatable, wide-scale exploitation is indicated. The PR:N metric is debatable for a self-XSS class where the victim must themselves enter the payload into an authenticated Panel; treat 'unauthenticated' framing with caution - realistically the payload enters via a user who already has Panel content-editing access, or via a side channel like the browser console for the email mark. The genuinely elevated case is stored XSS in custom Panel plugins that skip HTML sanitization, which could cross into other users' sessions and enable privilege escalation to admin. Bottom line: prioritize patching for multi-user Panels and plugin-heavy deployments; single-admin default installs face mostly self-XSS. |
| Exploit ScenarioDerived | An attacker with knowledge of a target site's blueprint structure socially engineers a Panel editor into pasting a crafted link whose target is a javascript: URL into a writer field, then convincing them to click it before saving. When clicked, the script runs in the editor's authenticated Panel session and can issue Kirby API requests with the victim's permissions; if the victim is an admin, this escalates attacker control. No public POC is identified, and the high attack complexity plus required interaction mean the attack cannot be automated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv5 – Jul 09, 2026
Cross-site scripting in Kirby CMS's Panel writer field (versions <= 4.9.3 and 5.0.0-alpha.1 through 5.4.3) lets an authenticated user inject a JavaScript-scheme URL into the link or email marks that executes in their own browser session when clicked before the content is saved. In Kirby's default configuration this is limited to self-XSS requiring social engineering, but Panel plugins that embed the <k-writer> component without sanitizing HTML before storage can be escalated to stored XSS affecting other users. There is no public exploit and it is not in CISA KEV; the vendor rates it high severity for affected sites.
Earlier versions of this analysis (4)
Self cross-site scripting (self-XSS) in the Kirby CMS Panel writer field lets a Panel user inject a JavaScript-scheme URL into the link or email mark that, once clicked by the same user before the content is saved, executes arbitrary JavaScript in their authenticated Panel session. It affects any Kirby site whose blueprints use the writer field (versions <= 4.9.3 and 5.0.0-alpha.1 through 5.4.3), and can escalate to stored XSS in Panel plugins that embed the <k-writer> component without sanitizing the saved HTML. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV; the attack cannot be automated and relies on social engineering.
Self and potential stored cross-site scripting in Kirby CMS (versions <= 4.9.3 and 5.0.0-alpha.1 through 5.4.3) lets a crafted javascript: URL be embedded as a link or email target in the writer field, executing arbitrary JavaScript in the Panel session when the target is clicked. In the default configuration the flaw is limited to self-XSS, requiring an authenticated Panel user to be socially engineered into clicking their own injected link before the content is saved; Panel plugins that use the <k-writer> component without sanitizing output can escalate this to stored XSS affecting other users. No public exploit identified at time of analysis and no EPSS/KEV data was supplied, but the vendor rates it high severity because a successful attack against an admin session enables privilege escalation via Kirby's authenticated API.
Stored/self cross-site scripting in Kirby CMS Panel (getkirby/cms <= 4.9.3 and 5.0.0-alpha.1 through 5.4.3) lets an attacker embed JavaScript-scheme links via the writer field's link and email marks, executing script in the Panel session when the authoring user clicks the crafted link before saving. In the default configuration the impact is limited to self-XSS requiring social engineering of a Panel user, but Panel plugins that render the <k-writer> component without sanitizing output can be exposed to true stored XSS affecting other users. No public exploit identified at time of analysis; it is not in CISA KEV, and the vendor rates it high severity for affected sites.
Self cross-site scripting in the Kirby CMS Panel writer field allows an authenticated Panel user to inject a javascript: URL into the link or email marks, which the same user can then click before saving to execute arbitrary JavaScript in their browser session. Panel plugins that embed the <k-writer> component without sanitizing the resulting HTML can escalate this to stored XSS affecting other Panel users. No public exploit identified at time of analysis, and the attack cannot be automated.
RemediationAI
Vendor-released patches exist: upgrade to Kirby 5.4.4 (https://github.com/getkirby/kirby/releases/tag/5.4.4) for the 5.x line, or to Kirby 4.9.4 (https://github.com/getkirby/kirby/releases/tag/4.9.4) as a backport for 4.x installs that cannot yet move to 5; the vendor recommends upgrading to Kirby 5 where possible. These releases add more robust validation against dangerous URL schemes entered in the writer marks. If immediate patching is not possible, reduce exposure by limiting Panel access to trusted users and enforcing least-privilege roles so that untrusted accounts cannot edit writer-field content (trade-off: restricts legitimate content workflows), and by advising editors never to click links inside a writer field before saving (weak, behavior-dependent control). For custom Panel plugins that use <k-writer>, add server-side HTML sanitization of the writer output before persisting it to content, which prevents the stored-XSS escalation but requires plugin code changes. Refer to the advisory at https://github.com/getkirby/kirby/security/advisories/GHSA-rhj6-r49h-5932 for details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Kirby is a PHP flat-file CMS whose administrative Panel provides a rich-text 'writer' field built on the Vue-based <k-writer> component. The field exposes 'link' and 'email' marks that let users attach URLs to text. The flaw is a CWE-83 issue (improper neutralization of script in a web page attribute): the client-side mark components accepted 'custom' URL types and email values containing javascript: scheme URLs and rendered them as clickable hrefs in the editing surface. While Kirby's backend sanitizes such URLs before writing them to the content file, the unsanitized link remained live and clickable in the browser during the editing session prior to save. Because the vulnerability lives in the shared writer mark components, every consumer of <k-writer> - including third-party Panel plugins - inherits the exposure. Affected packages are identified by CPE pkg:composer/getkirby_cms (Composer package getkirby/cms).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Network-reachable Panel but AC:H and UI:R reflect required content-structure knowledge, social engineering, and a click before save; C/I:H for session compromise, A:N as availability is unaffected.
Primary rating from Vendor (https://github.com/getkirby/kirby).
CVSS VectorVendor: https://github.com/getkirby/kirby
Lifecycle Timeline
5DescriptionCVE.org
TL;DR
This vulnerability affects Kirby sites that use the writer field in any blueprint.
It was possible to include a scripting link as the target of a link (or email link). This link target would then be clickable by the user who entered it.
A successful attack commonly requires knowledge of the content structure by the attacker as well as social engineering of a user with access to the Panel. The attack *cannot* be automated.
In Kirby's default configuration, the vulnerability is limited to self-XSS and *cannot* directly affect other users or visitors of the site. Panel plugins that are directly using the <k-writer> component may also be affected by stored XSS if they don't sanitize the resulting HTML before saving it to the content.
This vulnerability is of high severity for affected sites.
----
Introduction
Cross-site scripting (XSS) is a type of vulnerability that allows attackers to execute any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can, for example, trigger requests to Kirby's API with the permissions of the victim.
*Self* cross-site scripting (self-XSS) typically involves a user inadvertently executing malicious code within their own context, often through social engineering techniques. This can occur when a user is tricked into pasting and executing malicious JavaScript code into the browser's developer console, address bar or form fields.
In a *stored* XSS attack, the malicious payload is saved into the content data and has the potential to affect other users or site visitors.
Such vulnerabilities are critical if you might have potential attackers in your group of authenticated Panel users. They can escalate their privileges if they get access to the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible.
Affected components
The writer field allows users to input formatted text, including links to arbitrary URLs and email addresses. Its link and email marks are therefore a target for XSS attacks.
As the vulnerability is in the writer mark components, it also affects all uses of the <k-writer> component in Panel plugins.
Impact
In affected releases, the link and email marks did not prevent XSS payloads from being submitted to the writer field's content data:
- The
linkmark allowed users to enter JavaScript URLs using the "custom" URL type. These URLs would already be sanitized by the backend before storing the malicious link in the content file. However, the link may be clicked by the same user who entered it before the content is saved. - The
emailmark was also vulnerable to injected JavaScript URLs. However, it was not possible to perform the attack via the Panel user interface due to email validation. The attack needed to be performed via a side channel such as the browser console.
The vulnerability allows attackers to inject malicious links into content. If the authenticated user clicked such a link before saving the content, the malicious script code would then be executed in their browser.
Patches
The problem has been patched in Kirby 4.9.4 and Kirby 5.4.4. Please update to one of these or a later version to fix the vulnerability.
In all of the mentioned releases, we have added more robust validation against dangerous URL schemes that are entered in the affected writer marks.
Executive ViewAI
Kirby CMS Panel contains an XSS vulnerability affecting authenticated content management workflows. Organizations using custom Panel plugins without HTML sanitization face risk of stored XSS attacks that could compromise editor sessions and enable unauthorized content modification across managed sites.
Apply vendor patch. If patching is delayed: restrict Panel access to trusted administrators only, enforce approval workflows for content publication, and deploy strict CSP headers to prevent stored XSS execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB