Description
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins that use the writer or list fields or call Dom::sanitize(), Sane::sanitize(), Sane::Html::sanitize(), Sane::Svg::sanitize(), Sane::Xml::sanitize(), Sane::sanitizeFile(), or file sanitizeContents() with untrusted input allow malicious markup injected as children of an unknown HTML or XML tag to pass through Dom::sanitize() without being correctly sanitized, causing stored cross-site scripting. This issue is fixed in versions 4.9.4 and 5.4.4.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
getkirby kirby
< 4.9.4affected>= 5.0.0, < 5.4.4affected
References
- https://github.com/getkirby/kirby/security/advisories/GHSA-wr9h-4r83-f4v6 ↗
- https://github.com/getkirby/kirby/commit/0f0437b5128c910103cbc78fc34d94b2a3faef4c ↗
- https://github.com/getkirby/kirby/commit/7ad76cf9c7387462828e6ebfc8404e31b37829e9 ↗
- https://github.com/getkirby/kirby/commit/9ec1873864441dbc06479ef7823da348ec7f2700 ↗
- https://github.com/getkirby/kirby/commit/bb2562e16c754493a403b8df84c9883108871e4c ↗
- https://github.com/getkirby/kirby/releases/tag/4.9.4 ↗
- https://github.com/getkirby/kirby/releases/tag/5.4.4 ↗