CVE-2026-54002 Details

A stored cross-site scripting vulnerability has been identified in Kirby, an open-source content management system. This issue affects Kirby versions prior to 4.9.4 and 5.4.4. The vulnerability arises in sites and plugins that utilize the writer or list fields, or that call various sanitization methods from the Sane library, such as Dom::sanitize(), Sane::sanitize(), Sane::Html::sanitize(), Sane::Svg::sanitize(), Sane::Xml::sanitize(), Sane::sanitizeFile(), or file sanitizeContents() with untrusted input. The flaw allows malicious markup, injected as children of unknown HTML or XML tags, to bypass proper sanitization, creating a risk of stored cross-site scripting.

Users are advised to update Kirby to version 4.9.4 or 5.4.4, both of which address this vulnerability. After updating, review any content that was previously sanitized with the vulnerable method for potential malicious injections.