Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-32870— Kirby has XML injection in its XML creator toolkit

Quick assessment

Affected
getkirby kirby
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Kirby是Kirby开源的一套基于文件的内容管理系统（CMS）。 Kirby 4.9.0之前版本和5.4.0之前版本存在安全漏洞，该漏洞源于Xml::value()方法对CDATA块处理不当，可能导致绕过值保护，允许包含有效CDATA块之外的结构化数据通过。

AI Predicted 5.4 Difficulty: Moderate EPSS 0.35% · P28

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-32870

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Kirby has XML injection in its XML creator toolkit
Source: CVE Program / CVE List V5
Vulnerability Description
Kirby is an open-source content management system. Kirby's `Xml::value()` method has special handling for `<![CDATA[ ]]>` blocks. If the input value is already valid `CDATA`, it is not escaped a second time but allowed to pass through. However, prior to versions 4.9.0 and 5.4.0, it was possible to trick this check into allowing values that only contained a valid `CDATA` block but also contained other structured data outside of the `CDATA` block. This structured data would then also be allowed to pass through, circumventing the value protection. The `Xml::value()` method is used in `Xml::tag()`, `Xml::create()` and in the `Xml` data handler (e.g. `Data::encode($string, 'xml')`). Both the vulnerable methods and the data handler are not used in the Kirby core. However they may be used in site or plugin code, e.g. to create XML strings from input data. If those generated files are passed to another implementation that assigns specific meaning to the XML schema, manipulation of this system's behavior is possible. Kirby sites that don't use XML generation in site or plugin code are not affected. The problem has been patched in Kirby 4.9.0 and Kirby 5.4.0. In all of the mentioned releases, Kirby has added additional checks that only allow unchanged `CDATA` passthrough if the entire string is made up of valid `CDATA` blocks and no structured data. This protects all uses of the method against the described vulnerability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
XML注入(XPath盲注)
Source: CVE Program / CVE List V5
Vulnerability Title
Kirby 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Kirby是Kirby开源的一套基于文件的内容管理系统（CMS）。 Kirby 4.9.0之前版本和5.4.0之前版本存在安全漏洞，该漏洞源于Xml::value()方法对CDATA块处理不当，可能导致绕过值保护，允许包含有效CDATA块之外的结构化数据通过。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
getkirby kirby < 4.9.0 -

II. Public POCs for CVE-2026-32870

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-32870

请登录查看更多情报信息。

Vendor Pages for CVE-2026-32870 (1)

Same Patch Batch · getkirby · 2026-04-24 · 4 CVEs total

CVE-2026-41325 Kirby is vulnerable to authorization bypass during page, file and user creation via bluepr
CVE-2026-40099 Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraf
CVE-2026-34587 Kirby has Server-Side Template Injection (SSTI) via double template resolution in option r

IV. Related Vulnerabilities

Same product: kirby
Same vendor: getkirby
Same weakness: CWE-91

V. Comments for CVE-2026-32870

No comments yet

Leave a comment