Improper Neutralization of Script in Attributes in a Web Page in Kirby - CVE-2026-49276
Published: July 20, 2026
Vulnerability identifier: #VU138443
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-49276
CWE-ID: CWE-83
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary script code in the user's browser.
The vulnerability exists due to improper neutralization of script in attributes in a web page in the writer field link and email marks when handling user-supplied link targets. A remote user can inject a crafted javascript: link and cause script execution in the user's browser.
Successful exploitation commonly requires knowledge of the content structure and social engineering, and user interaction is required to click the crafted link before the content is saved. In the default configuration, the issue is limited to self-XSS within the Panel.
Affected software
Kirby
How to mitigate CVE-2026-49276
Install security update from vendor's website.
Kirby - addressed in versions 4.9.4, 5.4.4