Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
49 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
TL;DR This vulnerability affects all Kirby sites where user permissions are configured to prevent specific role(s) from performing write actions, specifically by disabling the update permission with the intent to prevent modifications to site content. If developers haven't configured any user permissions that deviate from the default of allowing all actions, their site is not affected. ---- Introduction Kirby allows to restrict the permissions of specific user roles. Users of that role can only perform permitted actions. Permissions for updating content have already existed and could be configured for each model type, but were not enforced by Kirby's API backend code during operations to the changes version. The changes version is the content version that contains unsaved changes of existing models (pages, users, files or the site). Impact The missing permission checks allowed attackers with Panel access to create or discard a changes version or update the content fields in an…
Recommended action: Upgrade to 5.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects all Kirby 5 sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to update page titles or usernames. The attack requires user interaction by another Panel user and cannot be automated. ---- Introduction Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. Such vulnerabilities are critical if you might have potential attackers in your group of authenticated Panel users. They can escalate their privileges if they get access to the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible. Impact The "Changes" dialog in the Panel displays all content models (pages, files, users) with changed content, i.e. with content that has not…
Recommended action: Upgrade to 5.1.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects all Kirby setups that use PHP's built-in server. Such setups are commonly only used during local development. Sites that use other server software (such as Apache, nginx or Caddy) are not affected. ---- Introduction For use with PHP's built-in web server, Kirby provides a router.php file. The router delegates requests to static files to PHP so that assets and other static files in the document root can be accessed by the browser. This logic was vulnerable against path traversal attacks. By using special elements such as .. and / separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the ../ sequence, which in most modern operating systems is interpreted as the parent directory of the current location. Impact The missing path traversal check allowed attackers to navigate all files on the server that were accessible to the PHP…
Recommended action: Upgrade to 4.7.1, 3.10.1.2 or 3.9.8.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects all Kirby sites that use the collection() helper or $kirby-collection() method with a dynamic collection name (such as a collection name that depends on request or user data). Sites that only use fixed calls to the collection() helper/$kirby-collection() method (i.e. calls with a simple string for the collection name) are not affected. ---- Introduction Kirby's collection() helper and $kirby-collection() method (in the following abbreviated to the collection() helper) allow to load PHP logic files that are normally stored in the site/collections folder or registered by plugins through the collections plugin extension. If the collection() helper is called with an arbitrary collection name, Kirby first checks if a file with this name exists in the collections root (which defaults to site/collections). This logic was vulnerable against path traversal attacks. By using special elements such as .. and / separators, attackers can escape outside of the…
Recommended action: Upgrade to 4.7.1, 3.10.1.2 or 3.9.8.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
3.10.1.14.3.13.8.4.43.9.8.23.6.6.63.7.5.5· Vendor fix available
Issue
TL;DR This vulnerability affects all Kirby sites with enabled languages option that might have potential attackers in the group of authenticated Panel users. If you have disabled the languages and/or api option and don't call any methods in your code that cause a write access to languages (language creation, update or deletion), your site is not affected. ---- Introduction Kirby allows to restrict the permissions of specific user roles. Users of that role can only perform permitted actions. Permissions for creating and deleting languages have already existed and could be configured, but were not enforced by Kirby's frontend or backend code. A permission for updating existing languages has not existed before the patched versions. So disabling the languages. wildcard permission for a role could not have prohibited updates to existing language definitions. Impact The missing permission checks allowed attackers with Panel access to manipulate the language definitions. The language…
Recommended action: Upgrade to 4.3.1, 3.10.1.1, 3.9.8.2 or 3 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects Kirby sites that use the new link field and output the entered link without additional validation or sanitization. The attack commonly requires user interaction by another user or visitor. The link dialog of the writer field is not affected as the writer field content is automatically sanitized by the Kirby backend code. You are also already protected if you limit the acceptable link types with the options field property. ---- Introduction Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. Such vulnerabilities are critical if you might have potential attackers in your group of authenticated Panel users. They can escalate their privileges if they get access to the Panel session of an admin user. Depending on your site, other…
Recommended action: Upgrade to 4.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
3.6.6.53.9.8.13.10.0.14.1.13.7.5.43.8.4.3· Vendor fix available
Issue
TL;DR This vulnerability affects Kirby sites that use the URL field in any blueprint. A successful attack commonly requires knowledge of the content structure by the attacker as well as social engineering of a user with access to the Panel. The attack cannot be automated. The vulnerability is also limited to self-XSS and cannot directly affect other users or visitors of the site. ---- Introduction Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. Self cross-site scripting (self-XSS, also called reflected XSS) typically involves a user inadvertently executing malicious code within their own context, often through social engineering techniques. This can occur when a user is tricked into pasting and executing malicious JavaScript code into the browser's developer…
Recommended action: Upgrade to 4.1.1, 3.10.0.1, 3.9.8.1 or 3 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
3.6.6.53.9.8.13.10.0.14.1.13.7.5.43.8.4.3· Vendor fix available
Issue
TL;DR This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users. The attack requires user interaction by another user or visitor and cannot be automated. ---- Introduction Unrestricted upload of files with a dangerous type is a type of vulnerability that allows to circumvent expectations and protections in the server setup or backend code. Uploaded files are not checked for their compliance with the intended purpose of the upload target, which can introduce secondary attack vectors. While the vulnerability described here does not allow critical attacks like remote code execution (RCE), it can still be abused to upload unexpected file types that could for example make it possible to perform cross-site scripting (XSS) attacks. Impact Users with Panel access can upload a user avatar in their own account view. This avatar is intended to be an image, however the file type or file extension was not validated on the backend.…
Recommended action: Upgrade to 4.1.1, 3.10.0.1, 3.9.8.1 or 3 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
3.8.4.13.7.5.23.6.6.33.9.63.5.8.3· Vendor fix available
Issue
TL;DR This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to update a Kirby content file (e.g. via a contact or comment form). Your Kirby sites are not affected if they don't allow write access for untrusted users or visitors. ---- Introduction A field injection in a content storage implementation is a type of vulnerability that allows attackers with content write access to overwrite content fields that the site developer didn't intend to be modified. In a Kirby site this can be used to alter site content, break site behavior or inject malicious data or code. The exact security risk depends on the field type and usage. Impact Kirby stores content of the site, of pages, files and users in text files by default. The text files use Kirby's KirbyData format where each field is separated by newlines and a line with four dashes (----). When reading a KirbyData file, the affected code first…
Recommended action: Upgrade to 3.9.6, 3.8.4.1, 3.7.5.2 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
3.8.4.13.7.5.23.6.6.33.9.63.5.8.3· Vendor fix available
Issue
TL;DR This vulnerability affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). It can only be abused if a Kirby user is logged in on a device or browser that is shared with potentially untrusted users or if an attacker already maliciously used a previous password to log in to a Kirby site as the affected user. ---- Introduction Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization. In the variation described in this advisory, it allows attackers to stay logged in to a Kirby site on another device or browser even if the logged in user has since changed their password. Impact Kirby did not invalidate old user sessions after the user password was changed by the user or by a site admin. If a user changed their password to lock out an attacker who was already in possession of the previous password or of a login session on another device or browser, the…
Recommended action: Upgrade to 3.9.6, 3.8.4.1, 3.7.5.2 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
3.8.4.13.7.5.23.6.6.33.9.63.5.8.3· Vendor fix available
Issue
TL;DR This vulnerability only affects Kirby sites that use the Xml data handler (e.g. Data::decode($string, 'xml')) or the Xml::parse() method in site or plugin code. The Kirby core does not use any of the affected methods. If you use an affected method and cannot rule out XML input controlled by an attacker, we strongly recommend to update to a patch release. ---- Introduction XML External Entities (XXE) is a little used feature in the XML markup language that allows to include data from external files in an XML structure. If the name of the external file can be controlled by an attacker, this becomes a vulnerability that can be abused for various system impacts like the disclosure of internal or confidential data that is stored on the server (arbitrary file disclosure) or to perform network requests on behalf of the server (server-side request forgery, SSRF). Impact Kirby's Xml::parse() method used PHP's LIBXMLNOENT constant, which enabled the processing of XML external entities…
Recommended action: Upgrade to 3.9.6, 3.8.4.1, 3.7.5.2 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
3.8.4.13.7.5.23.6.6.33.9.63.5.8.3· Vendor fix available
Issue
TL;DR This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to upload an arbitrary file to the content folder. Your Kirby sites are not affected if they don't allow file uploads for untrusted users or visitors or if the file extensions of uploaded files are limited to a fixed safe list. The attack requires user interaction by another user or visitor and cannot be automated. ---- Introduction Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. Such vulnerabilities are critical if you might have potential attackers in your group of authenticated Panel users. They can escalate their privileges if they get access to the Panel session of an admin user. Depending on your…
Recommended action: Upgrade to 3.9.6, 3.8.4.1, 3.7.5.2 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
3.8.4.13.7.5.23.6.6.33.9.63.5.8.3· Vendor fix available
Issue
TL;DR This vulnerability affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). The real-world impact of this vulnerability is limited, however we still recommend to update to one of the patch releases because they also fix more severe vulnerabilities. ---- Introduction Denial of service (DoS) is a type of attack in which an attacker floods a service with the intention to limit performance or availability for legitimate users of the service. In the variation described in this advisory (a so called application layer denial of service attack), it is performed by causing a computationally expensive task to be run on the server. This may then cause a performance bottleneck. Impact Kirby's authentication endpoint did not limit the password length. This allowed attackers to provide a password with a length up to the server's maximum request body length. Validating that password against the user's actual password requires hashing the provided…
Recommended action: Upgrade to 3.9.6, 3.8.4.1, 3.7.5.2 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). It can only be exploited for targeted attacks because the attack does not scale to brute force. ---- Introduction User enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company. User enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user. Impact Kirby comes with a built-in brute force protection. By default, it will prevent further login attempts after 10…
Recommended action: Upgrade to 3.8.1, 3.7.5.1, 3.6.6.2 or 3.5.8.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TL;DR This vulnerability only affects you if you are using the code or password-reset auth method with the auth.methods option. It can only be successfully exploited under server configuration conditions outside of the attacker's control. ---- Introduction User enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company. User enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user. Impact Under normal circumstances, entering an invalid email address results in a "fake" login code form…
Recommended action: Upgrade to 3.8.1, 3.7.5.1, 3.6.6.2 or 3.5.8.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Introduction Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. Such vulnerabilities are critical if you might have potential attackers in your group of authenticated Panel users. They can escalate their privileges if they get access to the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible. Impact The tags and multiselect fields allow to select tags from an autocompleted list. The tags field also allows to enter new tags or edit existing tags. Kirby already handled escaping of the autocompleted tags, but unfortunately the Panel used HTML rendering for new or edited tags as well as for custom tags from the content file. This allowed attackers with Panel access to store malicious HTML code in a tag. The browser of…
Recommended action: Upgrade to 3.7.4, 3.6.6.1 or 3.5.8.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Introduction Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. Such vulnerabilities are critical if you might have potential attackers in your group of authenticated Panel users. They can escalate their privileges if they get access to the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible. Impact The multiselect field allows to select tags from an autocompleted list. Unfortunately, the Panel in Kirby 3.5 used HTML rendering for the raw option value. This allowed attackers with influence on the options source (e.g. content of sibling pages or an API endpoint) to inject HTML code. If a page in the Panel that uses the manipulated multiselect options was visited by a victim and the victim opened the autocomplete…
Recommended action: Upgrade to 3.5.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file.
Recommended action: Upgrade to 2.5.7, 2.4.2 or 2.3.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Kirby's blocks field stores structured data for each block. This data is then used in block snippets to convert the blocks to HTML for use in your templates. We recommend to escape HTML special characters against cross-site scripting (XSS) attacks. Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the site frontend or Panel session of other users. If the user is logged in to the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. The default snippet for the image block unfortunately did not use our escaping helper. This made it possible to include malicious HTML code in the source, alt and link fields of the image block, which would then be displayed on the site frontend and executed in the browsers of site visitors and logged in users who are browsing the site. This vulnerability is critical if you might have potential attackers in your group of authenticated…
Recommended action: Upgrade to 3.5.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Kirby's writer field stores its formatted content as HTML code. Unlike with other field types, it is not possible to escape HTML special characters against cross-site scripting (XSS) attacks, otherwise the formatting would be lost. Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the site frontend or Panel session of other users. If the user is logged in to the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. Because the writer field did not securely sanitize its contents on save, it was possible to inject malicious HTML code into the content file by sending it to Kirby's API directly without using the Panel. This malicious HTML code would then be displayed on the site frontend and executed in the browsers of site visitors and logged in users who are browsing the site. This vulnerability is critical if you might have potential attackers in your group of…
Recommended action: Upgrade to 3.5.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
On Saturday, @hdodov reported that the Panel's ListItem component (used in the pages and files section for example) displayed HTML in page titles as it is. This could be used for cross-site scripting (XSS) attacks. We used his report as an opportunity to find and fix XSS issues related to dynamic site content throughout the Panel codebase. Impact Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the Panel session of other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. Such vulnerabilities are critical if you might have potential attackers in your group of authenticated Panel users. They can escalate their privileges if they get access to the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible. Visitors without Panel access can only use this attack vector if your site allows changing site data from a…
Recommended action: Upgrade to 3.5.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An editor with write access to the Kirby Panel can upload an SVG or XML file that contains harmful content like <script tags. The direct link to that file can be sent to other users or visitors of the site. If the victim opens that link in a browser where they are logged in to Kirby, the script will run and can for example trigger requests to Kirby's API with the permissions of the victim. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users. They can escalate their privileges if they get access to the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible. Visitors without Panel access can only use this attack vector if your site allows SVG or XML file uploads in frontend forms and you don't already validate or sanitize uploaded SVG or XML files. The attack requires user interaction by another user or visitor and cannot be automated. Patches Uploads in the Panel The…
Recommended action: Upgrade to 3.5.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact About our registration block In order to protect new installations on public servers that don't have an admin account for the Panel yet, we block account registration there by default. This is a security feature, which we implemented years ago in Kirby 2. It helps to avoid that you forget registering your first admin account on a public server. In this case – without our security block – someone else might theoretically be able to find your site, find out it's running on Kirby, find the Panel and then register the account first. It's an unlikely situation, but it's still a certain risk. To be able to register the first Panel account on a public server, you have to enforce the installer via a config setting. This helps to push all users to the best practice of registering your first Panel account on your local machine and upload it together with the rest of the site. The issue As noted by Jukka Rautanen, this installation block implementation in Kirby versions before 3.3.6…
Recommended action: Upgrade to 3.3.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact An editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors without Panel access cannot use this attack vector. Patches The problem has been patched in Kirby 2.5.14 and Kirby 3.4.5. Please update to one of these or a later version to fix the vulnerability. Note: Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14. Workarounds Kirby 2 sites on older releases can also be patched by applying the changes from this commit. Credits Thanks to Thore Imhof of Accenture for reporting the problem.
Recommended action: Upgrade to 3.4.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.