# CVE-2026-54002: Kirby CMS stored XSS in Dom sanitization component

Source: https://junglewise.ai/threats/cve-2026-54002-kirby-cms-stored-xss-in-dom-sanitization-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-54002 · Severity: high · CVSS 4 · Published 2026-07-09

Kirby, a content management system, is vulnerable to a security flaw where its built-in content filters fail to properly clean malicious code from certain text fields. An authenticated user could exploit this to inject harmful scripts into the website, potentially leading to the theft of user sessions or unauthorized actions when other users view the affected content. This issue primarily impacts sites using specific editor fields or custom plugins that process untrusted user input.

Technologies: [Kirby](https://junglewise.ai/threats/technologies/kirby), [getkirby/cms (Packagist)](https://junglewise.ai/threats/technologies/getkirby-cms). Vendors: [Kirby](https://junglewise.ai/threats/vendors/kirby), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-54002 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54002 being exploited in the wild.

**How severe is CVE-2026-54002?** High severity, with a CVSS score of 4, published 9 July 2026.

**Which products and versions are affected?** Kirby < 4.9.4, >= 5.0.0, < 5.4.4, <= 4.9.3, >= 5.0.0-alpha.1, <= 5.4.3; getkirby/cms (Packagist) ECOSYSTEM:introduced=0,fixed=4.9.4.

**Is there a fix for CVE-2026-54002?** Yes. getkirby/cms (Packagist): upgrade to 4.9.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54002 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54002?** Check whether you run Kirby or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- getkirby/cms (Packagist): upgrade to 4.9.4 or later

  ```sh
  composer require getkirby/cms:^4.9.4
  ```


## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Kirby CMS within the Dom::sanitize() method and related Sane classes. The root cause is a failure to correctly sanitize malicious markup when it is injected as children of unknown HTML or XML tags, allowing the payload to bypass sanitization rules. The vulnerability affects the 'writer' and 'list' fields, as well as any custom implementation calling Dom::sanitize() or Sane::sanitize() with untrusted input. An authenticated attacker with permissions to edit content can inject malicious scripts that execute in the context of other users' browsers. The issue is resolved in versions 4.9.4 and 5.4.4.

## Affected products

- getkirby Kirby < 4.9.4, >= 5.0.0, < 5.4.4

## Identifiers

- CVE-2026-54002
- GHSA-wr9h-4r83-f4v6

## Timeline

- 2026-06-17: patched: Security releases 4.9.4 and 5.4.4 published.
- 2026-07-09: advisory: NVD and GitHub advisory published.

## References

- [https://github.com/getkirby/kirby/commit/0f0437b5128c910103cbc78fc34d94b2a3faef4c](https://github.com/getkirby/kirby/commit/0f0437b5128c910103cbc78fc34d94b2a3faef4c)
- [https://github.com/getkirby/kirby/commit/7ad76cf9c7387462828e6ebfc8404e31b37829e9](https://github.com/getkirby/kirby/commit/7ad76cf9c7387462828e6ebfc8404e31b37829e9)
- [https://github.com/getkirby/kirby/commit/9ec1873864441dbc06479ef7823da348ec7f2700](https://github.com/getkirby/kirby/commit/9ec1873864441dbc06479ef7823da348ec7f2700)
- [https://github.com/getkirby/kirby/commit/bb2562e16c754493a403b8df84c9883108871e4c](https://github.com/getkirby/kirby/commit/bb2562e16c754493a403b8df84c9883108871e4c)
- [https://github.com/getkirby/kirby/releases/tag/4.9.4](https://github.com/getkirby/kirby/releases/tag/4.9.4)
- [https://github.com/getkirby/kirby/releases/tag/5.4.4](https://github.com/getkirby/kirby/releases/tag/5.4.4)
- [https://github.com/getkirby/kirby/security/advisories/GHSA-wr9h-4r83-f4v6](https://github.com/getkirby/kirby/security/advisories/GHSA-wr9h-4r83-f4v6)

## Related threats

- [Kirby path traversal in media handler via encoded slashes](https://junglewise.ai/threats/cve-2026-75594-kirby-path-traversal-in-media-handler-via-encoded-slashes)
- [Kirby path traversal in media handling via sibling directory bypass](https://junglewise.ai/threats/cve-2026-75592-kirby-path-traversal-in-media-handling-via-sibling-directory)
- [Kirby authorization bypass in REST API file uploads](https://junglewise.ai/threats/cve-2026-71415-kirby-authorization-bypass-in-rest-api-file-uploads)
- [Kirby REST API information disclosure via error messages](https://junglewise.ai/threats/cve-2026-69127-kirby-rest-api-information-disclosure-via-error-messages)
- [Kirby CMS stored XSS via dangerous URL schemes in KirbyTags](https://junglewise.ai/threats/cve-2026-45368-kirby-cms-stored-xss-via-dangerous-url-schemes-in-kirbytags)