CVE-2026-49276 | Kirby is an open-source content management system. Prior to … | CVSS 7.4 HIGH

Description

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the writer field in any blueprint allowed a scripting link to be included as the target of a link or email link in writer mark components, making the target clickable by the user who entered it and enabling self cross-site scripting in the Panel. This issue is fixed in versions 4.9.4 and 5.4.4.

Metadata

CVE ID: CVE-2026-49276
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-05-28 20:07 UTC
Published: 2026-07-09 18:48 UTC
Last updated: 2026-07-09 18:48 UTC
Primary CWE: CWE-83
CWE-83: Improper Neutralization of Script in Attributes in a…
Vendor / Product: getkirby / kirby
Sources: cve.org · NVD

Severity & Metrics

7.4 HIGH CVSS 4.0

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Affected products (1)

Vendor	Product	Platform	Versions
getkirby	kirby	—	< 4.9.4, >= 5.0.0, < 5.4.4

Weakness (CWE)

CWE	Source	Description
CWE-83	cna	CWE-83: Improper Neutralization of Script in Attributes in a Web Page

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.4	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References (3)

https://github.com/getkirby/kirby/security/advisories/GHSA-rhj6-r49h-5932 https://github.com/getkirby/kirby/security/advisories/GHSA-rhj6-r49h-5932
https://github.com/getkirby/kirby/releases/tag/4.9.4 https://github.com/getkirby/kirby/releases/tag/4.9.4
https://github.com/getkirby/kirby/releases/tag/5.4.4 https://github.com/getkirby/kirby/releases/tag/5.4.4