CyberRota Analysis
AI-GeneratedKirby CMS versions prior to 4.9.4 and 5.4.4 are vulnerable to self cross-site scripting due to the writer field in blueprints allowing users to include scripting links. This vulnerability could enable attackers to execute malicious scripts in the context of the user's session, potentially compromising user data and site integrity. Administrators of affected Kirby installations should prioritize upgrading to the patched versions to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the writer field in any blueprint allowed a scripting link to be included as the target of a link or email link in writer mark components, making the target clickable by the user who entered it and enabling self cross-site scripting in the Panel. This issue is fixed in versions 4.9.4 and 5.4.4.