CVE-2026-54002: Kirby CMS Cross-Site Scripting (XSS) Vulnerability Due to Incomplete HTML/XML Sanitization
Summary
CVE-2026-54002: Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in Dom::sanitize(). Affects getkirby/cms across 2 version ranges.
< 4.9.4
>= 5.0.0-alpha.1, < 5.4.4
Fixed in 4.9.4 or 5.4.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kirby is a flexible and powerful content management system (CMS) that allows users to create and manage websites with ease. It features a user-friendly interface, customizable fields, and a robust API for developers. However, a vulnerability has been identified in Kirby's sanitization methods, specifically in the handling of untrusted input, which can lead to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the Dom::sanitize() method, which fails to properly sanitize child nodes that have been unwrapped from their parent nodes. This oversight allows authenticated users to inject malicious JavaScript code into the content, which can then be executed in the context of other users, including administrators. The flaw is particularly dangerous in environments where multiple authenticated users have access to the Panel, as it can lead to stored XSS attacks, enabling attackers to escalate privileges and execute harmful scripts.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.9.44.9.4composer require getkirby/cms:4.9.4 -
>= 5.0.0-alpha.1, < 5.4.45.4.4composer require getkirby/cms:5.4.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not feasible, review and sanitize all content stored in affected fields to remove any potentially malicious scripts. Additionally, restrict access to the Panel for lower-privileged users until the update can be applied.
Conclusion
The CVE-2026-54002 vulnerability in Kirby CMS poses a significant risk due to its potential for cross-site scripting attacks. It is crucial for users to update to the patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for getkirby/cms →
FAQ
The vulnerability is a cross-site scripting (XSS) issue caused by improper sanitization of HTML/XML input in Kirby CMS.
Any Kirby CMS site or plugin that uses the writer or list fields, or the various sanitization methods with untrusted input is affected.
Authenticated users can inject malicious scripts into content fields, which may execute when viewed by other users, including administrators.
The CVSS score for this vulnerability is 8.5, indicating a high severity level.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using your composer.lock file. Check your application for vulnerabilities at Vulert Scanner without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for getkirby/cms.
