CVE-2026-49276: Kirby: Self cross-site scripting (self-XSS) in the writer field

Severity: high (CVSS 7.4 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-09 · updated 2026-10-25
Weakness: CWE-83

Description

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the writer field in any blueprint allowed a scripting link to be included as the target of a link or email link in writer mark components, making the target clickable by the user who entered it and enabling self cross-site scripting in the Panel. This issue is fixed in versions 4.9.4 and 5.4.4.

Affected products

getkirby kirby: before 4.9.4; from 5.0.0, < 5.4.4

References

https://github.com/getkirby/kirby/releases/tag/4.9.4
https://github.com/getkirby/kirby/releases/tag/5.4.4
https://github.com/getkirby/kirby/security/advisories/GHSA-rhj6-r49h-5932

Get alerted when CVE-2026-49276 or the next vulnerability affects your stack