Vulnerability in getkirby/cms (CVE-2026-49276)
Summary
Vulnerability in getkirby/cms (CVE-2026-49276). Risk of unauthorized operations or information disclosure. Exploitable via writer. Mitigation: upgrade to 5.4.4 or later.
Original description
The description as published by the source.
TL;DR
This vulnerability affects Kirby sites that use the writer field in any blueprint.
It was possible to include a scripting link as the target of a link (or email link). This link target would then be clickable by the user who entered it.
A successful attack commonly requires knowledge of the content structure by the attacker as well as social engineering of a user with access to the Panel. The attack cannot be automated.
In Kirby's default configuration, the vulnerability is limited to self-XSS and cannot directly affect other users or visitors of the site. Panel plugins that are directly using the `` component may also be affected by stored XSS if they don't sanitize the resulting HTML before saving it to the content.
This vulnerability is of high severity for affected sites.
Introduction
Cross-site scripting (XSS) is a type of vulnerability that allows attackers to execute any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can, for example, trigger requests to Kirby's API with the permissions of the victim.
Self cross-site scripting (self-XSS) typically involves a user inadvertently executing malicious code within their own context, often through social engineering techniques. This can occur when a user is tricked into pasting and executing malicious JavaScript code into the browser's developer console, address bar or form fields.
In a stored XSS attack, the malicious payloa…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-49276 has been found in getkirby/cms.
Attackers can target a specific entry point like writer over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade getkirby/cms to 5.4.4 or later.
If unsure, ask your IT team or search "getkirby/cms CVE-2026-49276" on the vendor's site.
CVE-2026-49276 (getkirby/cms) — CWE-83
Attack surface: writer / link / email
Patched: 5.4.4 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-83) exists in getkirby/cms. Attackers reach the vulnerable code path via writer.
Check the vendor advisory for the affected versions of getkirby/cms. Attack surface: writer / link / email.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to 5.4.4.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'getkirby/cms' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'getkirby/cms' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
getkirby/cmsを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade getkirby/cms to 5.4.4ステージング環境で 5.4.4 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- package github.com
- web github.com
- web github.com
- web github.com
- web github.com