CVE-2025-65012 Details
Description
Kirby is an open-source content management system. From versions 5.0.0 to 5.1.3, attackers could change the title of any page or the name of any user to a malicious string. Then they could modify any content field of the same model without saving, making the model a candidate for display in the "Changes" dialog. If another authenticated user subsequently opened the dialog in their Panel, the malicious code would be executed. This vulnerability affects all Kirby 5 sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to update page titles or usernames. The attack requires user interaction by another Panel user and cannot be automated. This issue has been patched in version 5.1.4.
A cross-site scripting vulnerability has been identified in Kirby, an open-source content management system, affecting versions 5.0.0 prior to 5.1.3. This vulnerability allows attackers to execute malicious JavaScript in the Panel session of users. The issue arises from the ability to change page titles or usernames to include harmful scripts, which could then be executed when another authenticated user views the 'Changes' dialog in the Panel. The vulnerability requires user interaction and cannot be automated, making it a concern for sites with potential attackers among authenticated Panel users or those allowing external visitors to modify page titles or usernames.
Users are advised to update Kirby to version 5.1.4 or later, where this vulnerability has been patched. The update includes necessary code changes to properly escape model titles, preventing the execution of malicious scripts.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 19, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getkirby/kirby/releases/tag/5.1.4 | [email protected] | Release Notes |
| https://github.com/getkirby/kirby/security/advisories/GHSA-84hf-8gh5-575j | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| getkirby kirby | >= 5.0.0, < 5.1.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 26, 2025 | Initial Analysis | [email protected] |
| Nov 18, 2025 | New CVE Received | [email protected] |