CVE-2026-49276

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.4 Kirby versions prior to 5.4.4

Description Kirby sites using the writer field in any blueprint are susceptible to cross-site scripting (XSS). The link and email marks within the writer components fail to prevent the submission of JavaScript URLs. Specifically, the link mark allows JavaScript URLs via the custom URL type, which can be clicked by the user who entered them before the content is saved. The email mark is also vulnerable, though exploitation requires a side channel like the browser console due to interface validation. In default configurations, this results in self-XSS, where a user executes malicious code in their own session. However, Panel plugins using the <k-writer> component may be subject to stored XSS if the resulting HTML is not sanitized before being saved. XSS is a vulnerability that allows the execution of JavaScript code within a user session, potentially enabling unauthorized API requests with the victim's permissions.

Recommendations Update Kirby to version 4.9.4 or later. Update Kirby to version 5.4.4 or later. Restrict the use of the writer field in blueprints until the updates are applied.