Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
49 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
TL;DR This vulnerability affects all Kirby sites that are deployed in a way that their index root on the server is next to a second directory that is read-accessible to PHP and shares the same name prefix (such as the site with the index root /var/www/site being next to /var/www/site2). It was possible to create and access thumbnails from media files within such sibling directories that have a valid thumbnail configuration (JSON job file). This can affect staging sites, site backups or other internal sites. ---- Introduction A path traversal (also known as directory traversal) vulnerability occurs when untrusted input is used to build a filesystem path without properly confining the result to an intended base directory. By injecting sequences such as ../, an attacker can escape that directory and reach files elsewhere on the server. Affected components Kirby's media handler processes requests for files in the media directory that have not been generated yet. It parses the provided…
Recommended action: Upgrade to 5.5.2 or 4.9.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' = false option. It was possible to trigger a PHP error in the API backend that would expose the full filesystem path of the Kirby installation on the server. This could be used to guess the default content.salt or prepare specialized attacks. ---- Introduction An information exposure occurs when system data or debugging information leaves the program through an output stream or logging function that makes it accessible to unauthorized parties. Using other weaknesses, an attacker could cause errors to occur; the response to these errors can reveal detailed system information, along with other impacts. An attacker can use messages that reveal technologies, operating systems, and product versions to tune the attack against known vulnerabilities in these technologies. A product may use diagnostic methods that provide significant implementation details such as stack traces as part of its…
Recommended action: Upgrade to 5.5.2 or 4.9.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects all Kirby sites where users of a particular role have access to the REST API (access.panel permission is enabled) but no permission to upload any kind of file (files.create, files.replace and user/users.update permissions are all disabled). It was possible to fill up the temporary directory for chunked uploads with unfinished chunks even as a user without any upload permission. This vulnerability is of high severity for affected sites. Your Kirby sites are not affected if you intend all users of your site to be able to upload files. The vulnerability can only be exploited by authenticated users. It was not possible to bypass the actual permission checks for any files that end up in the content or site/accounts folders. ---- Introduction Missing authorization allows authenticated users to perform actions they are not intended to have access to. The effects of missing authorization can include unauthorized access to sensitive information as well as…
Recommended action: Upgrade to 5.5.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects all Kirby sites that are deployed to a server that allows requests for URLs with encoded slashes (%2f), such as nginx, PHP's built-in server or Apache setups that have the option AllowEncodedSlashes enabled. It was possible to create and access thumbnails from media files in arbitrary accessible directories on the server that have a valid thumbnail configuration (JSON job file). It was also possible to detect the presence of files with the .json file extension anywhere on the server. This vulnerability is of high severity for affected sites. Server setups using Apache's default configuration or other servers that have been hardened against encoded slashes in URLs are not affected. ---- Introduction A path traversal (also known as directory traversal) vulnerability occurs when untrusted input is used to build a filesystem path without properly confining the result to an intended base directory. By injecting sequences such as ../, an attacker can escape…
Recommended action: Upgrade to 5.5.2 or 4.9.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to access pages (pages.access permission is disabled). This can be due to configuration in the user blueprint(s), options in the model blueprint(s), or a combination of both settings. It was possible to retrieve page information (including full content and metadata) for arbitrary pages via the /api/site/find route without being authorized to access the respective pages. This vulnerability is of high severity for affected sites. Your Kirby sites are not affected if you intend all users of your site to be able to access all pages of the site. The vulnerability can only be exploited by authenticated users that know or guess the IDs or UUIDs of pages. Write actions as well as access to draft pages are not affected by this vulnerability. ---- Introduction Missing authorization allows authenticated users to perform actions they are not intended to have access to. The effects of missing…
Recommended action: Upgrade to 5.4.4 or 4.9.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects Kirby 5 sites that have the content.fileRedirects option enabled (set to true or a custom closure) as well as all Kirby 4 sites that haven't explicitly disabled this option. It was possible to access clean file URLs of top-level drafts (e.g. /about-us/team.jpg) without providing authentication, without being authorized to access the top-level draft page, and without providing a valid preview token. Sites on Kirby 5 using the default configuration are not affected by this vulnerability (the content.fileRedirects option is disabled by default since Kirby 5.0.0). It was also not possible to maliciously access clean file URLs for files stored in page drafts that are not on the top-level (such as /blog/article/resource.pdf). ---- Introduction Missing authorization allows authenticated users to perform actions they are not intended to have access to. The effects of missing authorization can include unauthorized access to sensitive information as well as…
Recommended action: Upgrade to 5.4.4 or 4.9.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects Kirby sites that have no configured user accounts and are running on publicly accessible servers behind a reverse proxy that sets the Forwarded: for=..., X-Client-IP, or X-Real-IP request header. It was possible to install the Panel (= create the first admin user) in these setups even from remote IP addresses. This vulnerability is of critical severity for affected sites. Your site is not affected if any of the following apply: - An admin account has already been configured - The Panel and API are disabled - The site is not running behind a reverse proxy - The reverse proxy sets the X-Forwarded-For or Client-IP header instead of the affected ones. ---- Introduction External Initialization is a type of vulnerability that allows attackers to initialize a system or configuration value without authentication. This can give untrusted actors access to the system or let them control its behavior. Affected components The Kirby Panel and REST API are…
Recommended action: Upgrade to 5.4.4 or 4.9.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects Kirby sites and plugins that use the writer or list fields or that use $dom-sanitize(), Sane::sanitize(), Sane\Html::sanitize(), Sane\Svg::sanitize(), Sane\Xml::sanitize(), Sane::sanitizeFile() or $file-sanitizeContents() with untrusted input. It was possible to inject malicious markup as children of an unknown HTML/XML tag, which would then be passed through Dom::sanitize() without being correctly sanitized according to the provided sanitization rules, causing a cross-site scripting (XSS) risk. This vulnerability is of high severity for affected sites. The default file upload protection is not affected, so sites that only validate uploaded files are not exposed to this vulnerability. The vulnerability can only be exploited by authenticated users. ---- Introduction Cross-site scripting (XSS) is a type of vulnerability that allows executing any kind of JavaScript code inside the site frontend or Panel session of the same or other users. In the Panel, a…
Recommended action: Upgrade to 5.4.4 or 4.9.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects Kirby sites and plugins that use the Kirby\Http\Remote class (including Remote::request(), Remote::get(), Remote::post(), and similar helpers) to send outgoing HTTP requests and that pass untrusted, user-controlled data into the headers option of such a request. By including newline characters in the value of the header, it was possible to inject a separate, independent header that was not intended to be set. A successful attack requires that an application or plugin forwards attacker-influenced input into a request header value. Sites that only send static, developer-defined headers are not affected. The attack does not target Panel users or site visitors directly; it targets the remote service that Kirby connects to. In Kirby's default configuration, the Remote class is not exposed to untrusted input, so a default installation is not affected. The vulnerability becomes relevant for custom code, plugins, or integrations that build request headers…
Recommended action: Upgrade to 5.4.4 or 4.9.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects Kirby sites that use the writer field in any blueprint. It was possible to include a scripting link as the target of a link (or email link). This link target would then be clickable by the user who entered it. A successful attack commonly requires knowledge of the content structure by the attacker as well as social engineering of a user with access to the Panel. The attack cannot be automated. In Kirby's default configuration, the vulnerability is limited to self-XSS and cannot directly affect other users or visitors of the site. Panel plugins that are directly using the <k-writer component may also be affected by stored XSS if they don't sanitize the resulting HTML before saving it to the content. This vulnerability is of high severity for affected sites. ---- Introduction Cross-site scripting (XSS) is a type of vulnerability that allows attackers to execute any kind of JavaScript code inside the Panel session of the same or other users. In the…
Recommended action: Upgrade to 5.4.4 or 4.9.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects all Kirby sites that use the pages field and where users of a particular role have no permission to access pages (pages.access permission is disabled). This can be due to configuration in the user blueprint(s), options in the model blueprint(s), or a combination of both settings. It was possible to confirm the existence of arbitrary pages and to retrieve the value of the title field of the pages found. The vulnerability can only be exploited by authenticated users. Write actions are not affected by this vulnerability. ---- Introduction Missing authorization allows authenticated users to perform actions they are not intended to have access to. The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information. Affected components Kirby's user permissions control which user role is allowed to perform specific actions on content models in the CMS. These…
Recommended action: Upgrade to 5.4.4 or 4.9.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects all Kirby sites that allow the use of the (link: …) KirbyTag, the link: parameter of the (image: …) KirbyTag, the built-in image block with a link or the HTML importer for blocks, when content is authored by users who may not be fully trusted. The attack requires an authenticated Panel user with update permission to any textarea or blocks field, or write access to content files through another vector (e.g. a frontend form or content sync pipeline). Another attack vector is the use of Html::a() or Html::link() with untrusted user input. This vulnerability is of high severity for affected sites. Kirby sites are not affected if none of the mentioned KirbyTags or block types are used, or if every user who can edit content is fully trusted. The attack only surfaces in the site frontend (i.e. in its templates). The Panel itself is unaffected and will not execute JavaScript that was injected into the textarea or blocks field content. --- Introduction…
Recommended action: Upgrade to 5.4.1 or 4.9.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects all Kirby sites that restrict the visibility of users for certain roles via the users.access or users.list permissions. A site is affected if users of a particular role are not allowed to see other users in the Panel, for example because the role's blueprint sets users.access: false or users.list: false as permission for the authenticated user role and/or as option for the target user role. A Kirby site is not affected if all authenticated Panel users are permitted to access and list other users. The vulnerability can only be exploited by authenticated users. --- Introduction Missing authorization allows authenticated users to gain access to information they are not intended to see. The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information. Affected components Kirby's user permissions control which user role is allowed to perform specific actions or…
Recommended action: Upgrade to 5.4.1 or 4.9.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects all Kirby sites on Kirby 5.3.0-5.4.0 and is independent from setup conditions and authentication. This vulnerability is of high severity for all Kirby sites. ---- Introduction Path traversal is a type of attack that allows to access arbitrary filesystem paths. By using special elements such as .. and / separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the ../ sequence, which in most modern operating systems is interpreted as the parent directory of the current location. Path traversal can give attackers information about the filesystem and directory structure on the server and can lead to additional attacks depending on the nature of the accessible files and directories. PHP file inclusion is a type of attack that allows to load and execute PHP files on the server that are not intended for direct inclusion. Depending on the…
Recommended action: Upgrade to 5.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to access pages (pages.access permission is disabled). This can be due to configuration in the user blueprint(s), via options in the model blueprint(s) or via a combination of both settings. Kirby sites are not affected if they intend all users of the site to be able to access all page drafts of the site. The vulnerability can only be exploited by authenticated users. Write actions are not affected by this vulnerability. ---- Introduction Missing authorization allows authenticated users to perform actions they are not intended to have access to. The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information. Affected components Kirby's user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in…
Recommended action: Upgrade to 5.4.1 or 4.9.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects all Kirby sites that use the list field or list block, when content is authored by users who may not be fully trusted. The attack requires an authenticated Panel user with update permission to any list field or list block. This vulnerability is of high severity for affected sites. Kirby sites are not affected if they don't use the list field (or blocks field with the list block) in any of their blueprints, or if every user who can edit content is fully trusted. The attack only surfaces in the site frontend (i.e. in the consuming project's templates). The Panel itself is unaffected and will not execute JavaScript that was injected into list field content. ---- Introduction Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the site frontend or Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the…
Recommended action: Upgrade to 5.4.1 or 4.9.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users. This vulnerability is of high severity for affected sites and has a high real-world impact. ---- Introduction Arbitrary method call is a type of arbitrary code execution. It is a vulnerability that allows attackers to run any commands or code of the attacker's choice on a target machine or in a target process. Depending on the set of accessible methods, this can lead to disclosure of sensitive information or to unintended and malicious write actions. Affected components Kirby's data model is made up of model objects that are contained in collection objects. These collections can be queried with methods such as $collection-filter(), $collection-sort(), $collection-group(), $collection-pluck() and $collection-findBy(). Each of these methods allows to query the models contained in the collection by any accessible model attribute (field or method). Kirby also…
Recommended action: Upgrade to 5.4.1 or 4.9.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users. ---- Introduction Missing authorization allows authenticated users to perform actions they are not intended to have access to. The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information. Impact Kirby's user permissions control which user role is allowed to perform specific actions in the CMS. These permissions are defined for each role in the user blueprint (site/blueprints/users/...). The permissions control the authorization of user actions (with handling of model-specific authorization omitted here for brevity). Kirby provides the access.system permission (among others) that controls access to the system area of the Kirby Panel. This area contains internal system information like the installed Kirby, plugin and server versions, security state and Kirby…
Recommended action: Upgrade to 5.4.0 or 4.9.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to update user information (user.update or users.update permission is disabled). This can be due to configuration in the blueprint(s) of the acting users, via options in the blueprint(s) of the target users or via a combination of both settings. Kirby sites are not affected if they intend all users of the site to be able to upload, replace or delete user avatars. The vulnerability can only be exploited by authenticated users. ---- Introduction Missing authorization allows authenticated users to perform actions they are not intended to have access to. The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information. Impact Kirby's user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user…
Recommended action: Upgrade to 5.4.0 or 4.9.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users. This vulnerability is of high severity for affected sites. Sites using Kirby are not affected if they intend all users of the site to be able to list and access the site model and all users and roles, including the content stored within these models. Write actions are not affected by this vulnerability as they were gated by permissions before. ---- Introduction Missing authorization allows authenticated users to perform actions they are not intended to have access to. The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information. Impact Kirby's user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint (site/blueprints/users/...). It is also…
Recommended action: Upgrade to 5.4.0 or 4.9.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to access or list pages or files (pages.access, pages.list, files.access or files.list permission is disabled). This can be due to configuration in the user blueprint(s), via options in the model blueprint(s) or via a combination of both settings. This vulnerability is of high severity for affected sites. Consumers' Kirby sites are not affected if they intend all users to be able to access all pages and files of the site. The vulnerability can only be exploited by authenticated users. Write actions are not affected by this vulnerability. ---- Introduction Missing authorization allows authenticated users to perform actions they are not intended to have access to. The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information. Impact Kirby's user permissions control which user role is allowed…
Recommended action: Upgrade to 5.4.0 or 4.9.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to create pages, files or users (pages.create, files.create or users.create permission is disabled). This can be due to configuration in the user blueprint(s), via options in the model blueprint(s) or via a combination of both settings. This vulnerability is of high severity for affected sites. Developers' Kirby sites are not affected if they intend all users of their site to be able to create pages, files and users. The vulnerability can only be exploited by authenticated users. ---- Introduction An authorization bypass allows authenticated users to perform actions they should not be allowed to perform based on their configured permissions, thereby causing a privilege escalation. The effects of an authorization bypass can include unauthorized access to sensitive information as well as unauthorized changes to content or system information. Impact Kirby's user permissions control which…
Recommended action: Upgrade to 5.4.0 or 4.9.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects all Kirby sites where users have the permission to create pages (pages.create permission is enabled) but not the permission to change the status of pages (pages.changeStatus permission is disabled). This can be due to configuration in the user blueprint(s), via options in the page blueprint(s) or via a combination of both settings. Users' Kirby sites are not affected if their use case does not consider the creation of published pages a malicious action. The vulnerability can only be exploited by authenticated users. ---- Introduction An authorization bypass allows authenticated users to perform actions they should not be allowed to perform based on their configured permissions, thereby causing a privilege escalation. The effects of an authorization bypass can include unauthorized access to sensitive information as well as unauthorized changes to content or system information. Impact Kirby's user permissions control which user role is allowed to…
Recommended action: Upgrade to 5.4.0 or 4.9.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects all Kirby sites that use option fields (checkboxes, color, multiselect, select, radio, tags or toggles) with options from a query or API whose values may not be fully trusted. It also affects direct uses of the OptionsApi or OptionsQuery classes of Kirby's Options package from plugin or site code. The attack requires either an attacker in the group of authenticated Panel users or user interaction of another authenticated user. This vulnerability is of high severity for affected sites. Users' Kirby sites are not affected if they are not using any of the mentioned fields or the Options package, if all options are defined statically in the blueprints or if all dynamically gathered options are to be trusted. ---- Introduction Server-Side Template Injection vulnerabilities (SSTI) occur when user input is embedded in a template in an unsafe manner and results in remote code execution on the server. Injected user input is wrongly treated as a template…
Recommended action: Upgrade to 5.4.0 or 4.9.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability only affects Kirby sites that use the Xml data handler (e.g. Data::encode($string, 'xml')) or the Xml::create(), Xml::tag() or Xml::value() method(s) in site or plugin code. The Kirby core does not use any of the affected methods. If consumers use an affected method and cannot rule out input to these methods controlled by an attacker, Kirby strongly recommends that they update to a patch release. ---- Introduction XML strings contain structured data in tags and attributes. Depending on the used XML schema, this data can carry specific meaning that can lead to actions in other systems that parse and act on the XML data. Tags and attributes are detected based on their specific syntax, which includes characters such as <, , ", and &. If these characters are to be used verbatim in text within the XML string, they can be escaped using a <![CDATA[ ]] block. XML injection is an attack on a system generating or parsing XML files. By injecting special characters into…
Recommended action: Upgrade to 5.4.0 or 4.9.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.