CVE-2026-45368 Details
Description
Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks components did not filter out malicious URL values that resolve to script execution. The vulnerability affects four first-party Kirby renderers that produce `<a href="…">` output from editor-supplied field values: the (`link: …)` KirbyTag, the `link`: parameter of the `(image: …)` KirbyTag when it does not resolve to a known file or `self`, the `link` field of the built-in image block, and the HTML importer for the `blocks` field (which accepted the same malicious input as the image block `link` field). While simple `avascript:` URLs were already deactivated by treating them as a relative path and prepending a single slash to the URL, the use of URLs of the format `javascript://x%0A…` bypasses this protection. The `vbscript:`, `data:`, `livescript:`, `mocha:` and `jar:` schemes are affected by the same underlying gap. This issue has been fixed in versions 4.9.1 and 5.4.1.
A cross-site scripting (XSS) vulnerability has been identified in Kirby, an open-source content management system, affecting versions prior to 4.9.1 and 5.4.1. The issue arises in the KirbyTags and image blocks components, where the URL methods failed to filter out malicious URLs that could be executed as scripts. This vulnerability impacts four first-party Kirby renderers that create links from user-supplied content: the 'link' KirbyTag, the 'link' parameter of the 'image' KirbyTag (when it doesn't point to a known file or 'self'), the 'link' field in the built-in image block, and the HTML importer for blocks. The vulnerability is triggered when content is authored by users who may not be fully trusted, allowing for the injection of harmful scripts that could be executed in the site frontend or through a compromised Panel session.
Users can update to Kirby versions 4.9.1 or 5.4.1 to address this vulnerability. In these releases, the URL handling methods have been improved to detect and neutralize dangerous schemes, preventing them from being executed as scripts when links are clicked.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 16, 2026CISA-ADP
Assessed Jul 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getkirby/kirby/releases/tag/5.4.1 | [email protected] | BundleRelease NotesVendor |
| https://github.com/getkirby/kirby/security/advisories/GHSA-qvjf-922g-pj44 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Kirby | <= 4.9.0 (semver) >= 5.0.0, <= 5.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 18, 2026 | CVE Modified | CISA-ADP |
| Jul 16, 2026 | New CVE Received | [email protected] |