SB20260917227 - Multiple vulnerabilities in Kirby

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260917227

SB20260917227 - Multiple vulnerabilities in Kirby

Published: September 17, 2026

Security Bulletin ID SB20260917227
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 9% Low 91%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 vulnerabilities.


1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary script in the browsers of Panel users.

The vulnerability exists due to cross-site scripting in Kirby language variables when rendering overwritten translation strings as HTML. A remote user can create or update a language with a malicious variable that overwrites a built-in translation string to execute arbitrary script in the browsers of Panel users.

Exploitation affects multi-language sites and requires a victim to open the Panel in the affected language.


2) Incorrect Behavior Order: Validate Before Canonicalize (CVE-ID: N/A)

CWE-ID: CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to validate-before-canonicalize behavior in Dom::isAllowedUrl() when processing URLs in uploaded SVG files. A remote user can upload a crafted SVG file containing a reference to an attacker-controlled origin to disclose sensitive information.

The SVG must be rendered for the external reference to be fetched, which can expose the viewer\'s IP address, User-Agent, and request timing.


3) Incorrect Behavior Order: Validate Before Canonicalize (CVE-ID: N/A)

CWE-ID: CWE-180 - Incorrect Behavior Order: Validate Before Canonicalize

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to validate-before-canonicalize behavior in SaneSvg::sanitizeAttr() when processing nested constructs in uploaded SVG files. A remote user can upload a crafted SVG file containing nested constructs to cause a denial of service.

The SVG must be rendered for browser resources to be exhausted.


4) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to missing authorization in the `files`, `pages`, and `users` field model-resolution logic when resolving IDs stored in content files into models for Panel views. A remote user can write the ID of an inaccessible page, file, or user into an updatable field to disclose sensitive information.

For files, the disclosed media URL includes the token that authorizes access to the file.


5) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify page content and create text files in arbitrary writable locations.

The vulnerability exists due to path traversal in the template prop in Page::create() and $page->createChild() when processing a template name during page creation. A remote user can submit a crafted template name to modify page content and create text files in arbitrary writable locations.

Written files use the configured content extension and are only written, not read.


6) Inclusion of Functionality from Untrusted Control Sphere (CVE-ID: N/A)

CWE-ID: CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose limited sensitive information and alter rendered content.

The vulnerability exists due to incomplete URL detection in SaneSvg and SaneSvgz CSS @import rule handling when processing uploaded SVG or SVGZ files. A remote user can upload a crafted SVG that references an external stylesheet to disclose limited sensitive information and alter rendered content.

The stylesheet is loaded only when the SVG is rendered as a document, including direct media URL access, object or iframe embedding, or inlined SVG content.


7) Improper Neutralization of Alternate XSS Syntax (CVE-ID: N/A)

CWE-ID: CWE-87 - Improper Neutralization of Alternate XSS Syntax

CVSSv4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary script.

The vulnerability exists due to improper neutralization of alternate cross-site scripting syntax in Dom::sanitize() when sanitizing SVG or XML content for inline embedding. A remote user can submit crafted SVG or XML content for inline rendering to execute arbitrary script.

The rendered page must be viewed by another user.


8) Improper Authentication (CVE-ID: N/A)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to authenticate as another user.

The vulnerability exists due to improper authentication in the KirbyCmsAuth class when handling failed authentication challenge requests. A remote user can use a one-time code issued for their own account to authenticate as another user.

Exploitation requires control of an account whose email can be read and knowledge of the victim\'s email address.


9) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary scripts in the browsers of site visitors and logged-in users.

The vulnerability exists due to improper neutralization of imported HTML in Kirby\'s HTML importer for blocks when importing HTML into blocks or layout fields. A remote user can paste crafted table or non-video iframe HTML into an updatable field to execute arbitrary scripts in the browsers of site visitors and logged-in users.

The Panel does not render imported block content as HTML.


10) External Control of File Name or Path (CVE-ID: N/A)

CWE-ID: CWE-73 - External Control of File Name or Path

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to write content to arbitrary locations on the server.

The vulnerability exists due to external control of file name or path in Kirby page creation functionality when processing unfiltered root or dirname parameters. A remote user can submit a page creation request with crafted path parameters to write content to arbitrary locations on the server.

The Panel\'s page creation dialog is not an entry point.


11) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to write account files to arbitrary writable directories.

The vulnerability exists due to improper limitation of a pathname to a restricted directory in Kirby user creation when creating a user with a crafted ID. A remote privileged user can supply a crafted user ID to write account files outside the accounts directory.

The written filenames are index.php and .htpasswd.


Remediation

Install update from vendor's website.

References