Description
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the writer field in any blueprint allowed a scripting link to be included as the target of a link or email link in writer mark components, making the target clickable by the user who entered it and enabling self cross-site scripting in the Panel. This issue is fixed in versions 4.9.4 and 5.4.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| getkirby | kirby | < 4.9.4, >= 5.0.0, < 5.4.4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | getkirby/cms | < 4.9.4 | 4.9.4 | GHSA-rhj6-r49h-5932 |
| Packagist | getkirby/cms | >= 5.0.0-alpha.1, < 5.4.4 | 5.4.4 | GHSA-rhj6-r49h-5932 |