Read the docs
TI-2021-12403 Aliases CVE-2021-32735GHSA-2f2w-349x-vrqm

Cross-site scripting (XSS) from field and configuration text displayed in the Panel

Priority LOW 32CWE-80Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-80.

Summary

Kirby is a content management system. In Kirby CMS versions 3.5.5 and 3.5.6, the Panel's `ListItem` component (used in the pages and files section for example) displayed HTML in page titles as it is. This could be used for cross-site scripting (XSS) attacks. Malicious authenticated Panel users can escalate their privileges if they get access to the Panel session of an admin user. Visitors without Panel access can use the attack vector if the site allows changing site data from a frontend form. Kirby 3.5.7 patches the vulnerability. As a partial workaround, site administrators can protect against attacks from visitors without Panel access by validating or sanitizing provided data from the frontend form.

Why it matters now

EPSS 0.00532 45th percentileScored 2026-11-07
Fix Fixed getkirby/cms (Packagist): 3.5.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
getkirbykirby<= 3.5.5, <= 3.5.6—No fix listedCNA
—getkirby/cms (Packagist)before 3.5.73.5.7Patch availableGHSA-2f2w-349x-vrqm
  • kirby Vendorgetkirby Affected <= 3.5.5, <= 3.5.6 Fixed in — No fix listed CNA
  • getkirby/cms (Packagist) Vendor— Affected before 3.5.7 Fixed in 3.5.7 Patch available GHSA-2f2w-349x-vrqm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*before 3.5.7Vulnerablegetkirby
  • cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:* Versions before 3.5.7 Vulnerable ·getkirby

Remediation

  • Fix · GHSA-2f2w-349x-vrqm getkirby/cms (Packagist) Fixed in 3.5.7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32735
  2. 2026-10-03 Alias added: GHSA-2f2w-349x-vrqm

References

Patch 2

Advisory 1

Other 2

  • TI-2024-17440 An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0… CVSS 3.1HIGH 8.8
  • TI-2024-17439 An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS… CVSS 3.1HIGH 7.1
  • TI-2026-23396 Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a… CVSS 3.1MEDIUM 6.5
  • TI-2024-17441 A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of… CVSS 3.1MEDIUM 6.1
  • TI-2018-10413 An issue was discovered in Kirby 2.5.12. CVSS 3.1MEDIUM 5.4
  • TI-2024-17438 Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter. CVSS 3.1MEDIUM 4.7
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences