Kirby CMS Multiple Vulnerabilities (XSS, IDOR, Header Injection) Advisory

Vulnerability Overview 1. Issue with the External Initialization Panel in Reverse Proxy Configurations Description: Affects Kirby sites that have no user accounts configured and are running on publicly accessible servers using , , or request headers. Severity: High (CVSS Score 9.1) CVE ID: CVE-2026-54003 Recommendation: Set and to long, random strings. 2. Cross-Site Scripting (XSS) Due to Incomplete HTML/XML Sanitization Description: Affects Kirby sites and plugins that use the or fields, or that call , , , , or . Severity: High (CVSS Score 8.5) CVE ID: CVE-2026-54002 Recommendation: Ensure all input is processed with correct sanitization rules. 3. Self-XSS in the Writer Field Description: Affects Kirby sites using the writer field. An attacker can inject scripts by including a clickable link. Severity: High (CVSS Score 7.4) CVE ID: CVE-2026-49276 Recommendation: Avoid directly inserting script links into the writer field. 4. REST API Route Does Not Check Permissions Description: Affects Kirby sites where permissions are not configured, allowing unauthorized access to arbitrary page information. Severity: High (CVSS Score 7.1) CVE ID: CVE-2026-54005 Recommendation: Ensure permissions are correctly configured. 5. Request Header Injection in Description: Affects Kirby sites and plugins using the class. An attacker can inject separate request headers by injecting newline characters. Severity: Medium (CVSS Score 6.9) CVE ID: CVE-2026-50188 Recommendation: Validate and sanitize all user input. 6. Unprotected Access to Top-Level Draft Files Description: Affects Kirby 5 sites with the option enabled, and Kirby 4 sites where this option is not explicitly disabled. Severity: Medium (CVSS Score 6.3) CVE ID: CVE-2026-54004 Recommendation: Disable the option or ensure permissions are correctly configured. 7. Parent Page Permissions Not Checked in Selector Description: Affects Kirby sites using the field where permissions are not configured. Severity: Medium (CVSS Score 5.3) CVE ID: CVE-2026-49274 Recommendation: Ensure permissions are correctly configured. Affected Components All Kirby sites with no user accounts configured and running on publicly accessible servers. Kirby sites and plugins using the or fields, or calling specific sanitization methods. Kirby sites using the writer field. Kirby sites where permissions are not configured. Kirby sites and plugins using the class. Kirby 5 sites with the option enabled, and Kirby 4 sites where this option is not explicitly disabled. Kirby sites using the field where permissions are not configured. Remediation Set and to long, random strings. Ensure all input is processed with correct sanitization rules. Avoid directly inserting script links into the writer field. Ensure permissions are correctly configured. Validate and sanitize all user input. Disable the option or ensure permissions are correctly configured. Ensure permissions are correctly configured. Security Fixes Protect the field against Self-XSS attacks. Update the selector to only return pages accessible by the current user. Filter the results of the API route. Prevent panel installation via external IP addresses. Display a warning in the system view if the default values for and have not been changed. Enhancements Enhance TOTP token validation with constant-time verification. Add a new JS helper. Add a new helper. Allow setting directly from configuration. Bug Fixes Fixed navigation button issues in the account view. Fixed header detection in . Fixed TLD issues in email links. Fixed column existence issues in database queries. Fixed invalid JSON handling in . Fixed special character escaping in . Fixed script loading issues in . Fixed blueprint field key normalization issues. Fixed escaping attribute issues in . Fixed QR code data exceeding capacity issues. Fixed content metadata fallback issues. Fixed division by zero error in . Fixed in . Fixed an issue where node configurations were ignored when clearing references. Breaking Changes and the tag now ignore URLs from hosts other than . Contributors adamyordan, adrgs, and 3 other contributors. Assets 2 assets.

Goal Reached Thanks to every supporter — we hit 100%!

Kirby CMS Multiple Vulnerabilities (XSS, IDOR, Header Injection) Advisory

More from this source