Improper Neutralization of Script in Attributes in a Web Page in Kirby - CVE-2026-49276
Published: July 20, 2026
Vulnerability identifier: #VU138443
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-49276
CWE-ID: CWE-83
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Ian Stewart
Affected software:
Kirby
Kirby
Detailed vulnerability description
The vulnerability allows a remote user to execute arbitrary script code in the user's browser.
The vulnerability exists due to improper neutralization of script in attributes in a web page in the writer field link and email marks when handling user-supplied link targets. A remote user can inject a crafted javascript: link and cause script execution in the user's browser.
Successful exploitation commonly requires knowledge of the content structure and social engineering, and user interaction is required to click the crafted link before the content is saved. In the default configuration, the issue is limited to self-XSS within the Panel.
How to mitigate CVE-2026-49276
Install security update from vendor's website.