Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

kirby — Vulnerabilities & Security Advisories 47

All 47 CVE vulnerabilities found in kirby, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security advisories for the product Kirby, focusing specifically on software vulnerabilities and their associated weakness classifications. The collection encompasses a chronological history of known security flaws affecting this content management system, spanning from its initial releases through the most recent updates. Users can utilize this resource to track vendor-specific advisory patterns, analyze the prevalence of particular weakness types within the codebase, and review the complete vulnerability timeline for this digital publishing tool. By filtering records by severity, affected version, or vulnerability category, stakeholders can identify recurring security themes, evaluate remediation trends, and understand how specific classes of defects, such as cross-site scripting or privilege escalation, have evolved over time. This structured aggregation facilitates comparative analysis and supports informed risk assessment for organizations relying on Kirby for their digital infrastructure. The data reflects public security bulletins and vulnerability reports, providing a consolidated view without requiring separate lookups across multiple security databases.

Vendor: getkirby

CVE ID Title CVSS Severity Published
CVE-2025-30159 Kirby vulnerable to path traversal of snippet names in the `snippet()` helper CWE-22 7.1AI High AI 2025-05-13
CVE-2024-41964 Insufficient permission checks in the language settings in Kirby CMS CWE-863 8.1 High 2024-08-29
CVE-2024-27087 Kirby cross-site scripting (XSS) in the link field "Custom" type CWE-79 4.6 Medium 2024-02-26
CVE-2023-38492 Kirby vulnerable to denial of service from unlimited password lengths CWE-770 5.3 Medium 2023-07-27
CVE-2023-38491 Kirby vulnerable to Cross-site scripting (XSS) from MIME type auto-detection of uploaded files CWE-79 5.7 Medium 2023-07-27
CVE-2023-38490 Kirby XML External Entity (XXE) vulnerability in the XML data handler CWE-611 6.8 Medium 2023-07-27
CVE-2023-38489 Kirby vulnerable to Insufficient Session Expiration after a password change CWE-613 7.3 High 2023-07-27
CVE-2023-38488 Kirby vulnerable to field injection in the KirbyData text storage handler CWE-140 7.1 High 2023-07-27
CVE-2022-39315 Kirby CMS vulnerable to user enumeration in the brute force protection CWE-204 6.5 Medium 2022-10-25
CVE-2022-39314 User enumeration in the code-based login and password reset forms CWE-307 5.3 - 2022-10-24
CVE-2022-36037 Cross-site scripting (XSS) from dynamic options in the multiselect field in Kirby CWE-79 5.9 Medium 2022-08-29
CVE-2021-41258 Cross-site scripting (XSS) from image block content in the site frontend CWE-79 7.3 High 2021-11-16
CVE-2021-41252 Cross-site scripting (XSS) from writer field content in the site frontend CWE-79 7.3 High 2021-11-16
CVE-2021-32735 Cross-site scripting (XSS) from field and configuration text displayed in the Panel CWE-80 7.1 High 2021-07-02
CVE-2021-29460 Cross-site scripting (XSS) from unsanitized uploaded SVG files CWE-79 7.6 High 2021-04-27
CVE-2020-26255 PHP Phar archives could be uploaded and executed in Kirby CWE-434 6.8 Medium 2020-12-08
CVE-2020-26253 .dev domains treated as local in Kirby CWE-346 6.8 Medium 2020-12-08

All 47 known CVE vulnerabilities affecting kirby with full Chinese analysis, references, and POCs where available.