CVE-2026-44175: Kirby CMS persistent XSS in list field

CVE-2026-44175 · Severity: high · CVSS 4 · Published 2026-07-16

Kirby, a content management system, contains a security flaw in how it handles list fields. An attacker with basic editing permissions can bypass the standard administrative interface to save malicious code that will then run in the browsers of other site visitors. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.

Technologies: Kirby, getkirby/cms (Packagist). Vendors: Kirby, Packagist.

Quick answers

Is CVE-2026-44175 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44175 being exploited in the wild.
How severe is CVE-2026-44175?
High severity, with a CVSS score of 4, published 16 July 2026.
Which products and versions are affected?
Kirby < 4.9.1, >= 5.0.0, < 5.4.1, <= 4.9.0, >= 5.0.0, <= 5.4.0; getkirby/cms (Packagist) ECOSYSTEM:introduced=0,fixed=4.9.1.
Is there a fix for CVE-2026-44175?
Yes. getkirby/cms (Packagist): upgrade to 4.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44175 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-44175?
Check whether you run Kirby or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • getkirby/cms (Packagist): upgrade to 4.9.1 or later
    composer require getkirby/cms:^4.9.1

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Kirby CMS versions prior to 4.9.1 and 5.4.1. The 'list' field and 'list' block store content as raw HTML to preserve formatting, but sanitization was previously only enforced client-side within the Panel UI. An authenticated attacker with update permissions can bypass the Panel and send malicious HTML directly to Kirby's REST API. Because the server failed to sanitize this input on save, the malicious markup is stored in the content files and executed when rendered on the site frontend. The issue is resolved by implementing server-side HTML sanitization for list fields.

Affected products

  • getkirby Kirby CMS < 4.9.1, >= 5.0.0, < 5.4.1

Identifiers

  • CVE-2026-44175
  • GHSA-5fhx-9q32-q257

Timeline

  • 2026-05-19: patched: Fixed in versions 4.9.1 and 5.4.1
  • 2026-07-16: advisory: CVE-2026-44175 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.