Security Advisory

CVE-2026-54002

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-09 18:34:29

Last updated 2026-07-09 19:26:59

Assigner GitHub_M

CVSS score 8.5

State PUBLISHED

Description

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins that use the writer or list fields or call Dom::sanitize(), Sane::sanitize(), Sane::Html::sanitize(), Sane::Svg::sanitize(), Sane::Xml::sanitize(), Sane::sanitizeFile(), or file sanitizeContents() with untrusted input allow malicious markup injected as children of an unknown HTML or XML tag to pass through Dom::sanitize() without being correctly sanitized, causing stored cross-site scripting. This issue is fixed in versions 4.9.4 and 5.4.4.

← Browse all CVEs View on cve.org ↗