Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins that use the writer or list fields or call Dom::sanitize(), Sane::sanitize(), Sane::Html::sanitize(), Sane::Svg::sanitize(), Sane::Xml::sanitize(), Sane::sanitizeFile(), or file sanitizeContents() with untrusted input allow malicious markup injected as children of an unknown HTML or XML tag to pass through Dom::sanitize() without being correctly sanitized, causing stored cross-site scripting. This issue is fixed in versions 4.9.4 and 5.4.4.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| getkirby | kirby | before 4.9.4; 5.0.0 to before 5.4.4 | 4.9.4, 5.4.4 | Patch available | CNA |
| — | getkirby/cms (Packagist) | before 4.9.4 | 4.9.4 | Patch available | GHSA-wr9h-4r83-f4v6 |
| — | getkirby/cms (Packagist) | 5.0.0-alpha.1 to before 5.4.4 | 5.4.4 | Patch available | GHSA-wr9h-4r83-f4v6 |
- kirby Vendorgetkirby Affected before 4.9.4; 5.0.0 to before 5.4.4 Fixed in 4.9.4, 5.4.4 Patch available CNA
- getkirby/cms (Packagist) Vendor— Affected before 4.9.4 Fixed in 4.9.4 Patch available GHSA-wr9h-4r83-f4v6
- getkirby/cms (Packagist) Vendor— Affected 5.0.0-alpha.1 to before 5.4.4 Fixed in 5.4.4 Patch available GHSA-wr9h-4r83-f4v6
Remediation
- Fix · CNA kirby (getkirby) Fixed in 4.9.4, 5.4.4
- Fix · GHSA-wr9h-4r83-f4v6 getkirby/cms (Packagist) Fixed in 4.9.4 Advisory →
- Fix · GHSA-wr9h-4r83-f4v6 getkirby/cms (Packagist) Fixed in 5.4.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54002
- 2026-10-03 Alias added: GHSA-wr9h-4r83-f4v6
References
Other 8
- https://github.com/getkirby/kirby/security/advisories/GHSA-wr9h-4r83-f4v6
- https://github.com/getkirby/kirby/commit/0f0437b5128c910103cbc78fc34d94b2a3faef4c
- https://github.com/getkirby/kirby/commit/7ad76cf9c7387462828e6ebfc8404e31b37829e9
- https://github.com/getkirby/kirby/commit/9ec1873864441dbc06479ef7823da348ec7f2700
- https://github.com/getkirby/kirby/commit/bb2562e16c754493a403b8df84c9883108871e4c
- https://github.com/getkirby/kirby/releases/tag/4.9.4
- https://github.com/getkirby/kirby/releases/tag/5.4.4
- https://github.com/getkirby/kirby
More getkirby vulnerabilities
- TI-2024-17440 An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0… CVSS 3.1HIGH 8.8
- TI-2024-17439 An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS… CVSS 3.1HIGH 7.1
- TI-2026-23396 Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a… CVSS 3.1MEDIUM 6.5
- TI-2024-17441 A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of… CVSS 3.1MEDIUM 6.1
- TI-2018-10413 An issue was discovered in Kirby 2.5.12. CVSS 3.1MEDIUM 5.4
- TI-2024-17438 Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter. CVSS 3.1MEDIUM 4.7
Sources
- CVE-2026-54002 · CVE Program
- CVE-2026-54002 · NVD
- FIRST EPSS
- GHSA-wr9h-4r83-f4v6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences