Getkirby Kirby

Kirby XML External Entity (XXE) vulnerability in the XML data handler

PHP Phar archives could be uploaded and executed in Kirby

Kirby vulnerable to path traversal of snippet names in the `snippet()` helper

Path traversal of collection names during file system lookup

An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute arbitrary code via a crafted PDF file.

Kirby vulnerable to field injection in the KirbyData text storage handler

Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection

Insufficient permission checks in the language settings in Kirby CMS

Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering

Cross-site scripting (XSS) from unsanitized uploaded SVG files

Kirby vulnerable to denial of service from unlimited password lengths

Kirby vulnerable to path traversal in the router for PHP's built-in server

Kirby has XML injection in its XML creator toolkit

Cross-site scripting (XSS) from writer field content in the site frontend

Kirby vulnerable to Insufficient Session Expiration after a password change

Cross-site scripting (XSS) from image block content in the site frontend

Cross-site scripting (XSS) from field and configuration text displayed in the Panel

Kirby: Read access to site, user and role information is not gated by permissions

Kirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialog

An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is backend sanitization such that the reporter's mentioned "injecting malicious scripts" would not occur.

.dev domains treated as local in Kirby

Kirby CMS vulnerable to user enumeration in the brute force protection

Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (DoS) via a malformed image upload. The application fails to properly validate the return value of the PHP getimagesize() function. When the system attempts to process this file for metadata or thumbnail generation, it triggers a fatal TypeError.

Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter

panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature.

A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of Kirby CMS v4.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Link field. NOTE: the vendor's position is that this issue did not affect any version of Kirby CMS. The only effect was on the trykirby.com demo site, which is not customer-controlled.

Cross-site scripting (XSS) from dynamic options in the multiselect field in Kirby

Kirby is missing permission checks in the content changes API

Kirby vulnerable to Cross-site scripting (XSS) from MIME type auto-detection of uploaded files

An issue was discovered in Kirby 2.5.12. The application allows malicious HTTP requests to be sent in order to trick a user into adding web pages.

panel/pages/home/edit in Kirby v2.5.12 allows XSS via the title of a new page.

panel/login in Kirby v2.5.12 allows XSS via a blog name.

Kirby cross-site scripting (XSS) in the link field "Custom" type

Kirby CMS has cross-site scripting (XSS) in the changes dialog

Kirby: System API endpoint leaks license data and installed version to authenticated users

Kirby: User avatar creation, replacement and deletion are not gated by user update permissions

Kirby V2.5.12 is prone to a Persistent XSS attack via the Title of the "Site options" in the admin panel dashboard dropdown.

Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file.

User enumeration in the code-based login and password reset forms

Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter.