Executive brief
Kirby CMS, a popular content management system, contains a security flaw that allows users with content editing permissions to inject malicious scripts into website links. If a site visitor or administrator clicks on one of these manipulated links, the attacker's script could execute in their browser, potentially leading to account takeover or unauthorized actions. This issue specifically affects sites where content is authored by users who are not fully trusted.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Kirby CMS due to insufficient filtering of dangerous URI schemes in the underlying URL methods used by KirbyTags and image blocks. While basic 'javascript:' schemes were previously blocked, attackers can bypass these filters using obfuscated formats like 'javascript://x%0A…' or other dangerous schemes such as 'vbscript:', 'data:', and 'jar:'. The vulnerability affects the (link: …) KirbyTag, the link parameter of the (image: …) KirbyTag, the image block link field, and the HTML importer for blocks. An attacker with 'update' permissions to textarea or blocks fields can inject these malicious URLs, which are then rendered as <a> tags in the site frontend. Exploitation requires a victim to click the malicious link. The issue is fixed in versions 4.9.1 and 5.4.1 by implementing a new dangerous scheme detection method.
Affected products
- getkirby Kirby CMS < 4.9.1, >= 5.0.0, < 5.4.1
Timeline
- 2026-05-19: patched: Versions 4.9.1 and 5.4.1 released
- 2026-05-19: advisory: GitHub Security Advisory GHSA-qvjf-922g-pj44 published
- 2026-07-16: disclosed: CVE-2026-45368 published to NVD