CVE-2025-65012
Medium · 4.6Kirby CMS has cross-site scripting (XSS) in the changes dialog
CVSS
4.6
EPSS
0.2%
Published
Nov 18, 2025
CISA due date
—
The record
The "Changes" dialog in the Panel displays all content models (pages, files, users) with changed content, i.e. with content that has not yet been published. Each changed model is listed with its preview image/icon and its title/name. Attackers could change the title of any page or the name of any user to a malicious string. Then they could modify any content field of the same model without saving, making the model a candidate for display in the "Changes" dialog. If another authenticated user subsequently opened the dialog in their Panel, the malicious code would be executed.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | getkirby/cms | 5.0.0 | 5.1.4 |
| packagist | getkirby/cms | 5.0.0 | 5.1.4 |
Related vulnerabilities
- GHSA-84hf-8gh5-575j Kirby CMS has cross-site scripting (XSS) in the changes dialog Same vulnerability
- GHSA-4j78-4xrm-cr2f Kirby is missing permission checks in the content changes API Also affects getkirby/cms
- CVE-2026-21896 Kirby is an open-source content management system. Also affects getkirby/cms
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79