{"answers":{"affected":"4 open source packages ship an affected version, including getkirby/cms and getkirby/panel. It affects 2 products.","exploited":"There is no known exploitation of CVE-2020-26253 in the wild and no public exploit code.","fix":"Upgrade getkirby/cms to 3.3.6 or later.","what":"CVE-2020-26253 is a medium-severity vulnerability in getkirby kirby, published on 8 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2020-26253 and fix it if it is affected.\n\nWhat it is: CVE-2020-26253 is a medium-severity vulnerability in getkirby kirby, published on 8 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2020-26253 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- getkirby/cms (Packagist): affected from 3.0.0; fixed in 3.3.6\n- getkirby/cms (Packagist): affected from 3.0.0; fixed in 3.3.6\n- getkirby/panel (Packagist): affected all versions; fixed in 2.5.14\n- getkirby/panel (Packagist): affected all versions; fixed in 2.5.14\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2020-26253/ (Markdown: https://insights.sbomify.com/CVE-2020-26253/index.md)","id":"CVE-2020-26253","markdown":"https://insights.sbomify.com/CVE-2020-26253/index.md","name":"CVE-2020-26253","record":{"aliases":["GHSA-2ccx-2gf3-8xvv"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["account_takeover"],"network_reachable":"yes","non_default_config":true,"product_category":"Kirby CMS","requires_auth":"none","summary":"Attackers can register the first admin account on Kirby CMS sites using .dev domains or behind reverse proxies, bypassing the local installation security block.","user_interaction":"not_required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"kirby","vendor":"getkirby"},{"product":"panel","vendor":"getkirby"}],"cvss":{"score":6.8,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-346","name":"Origin Validation Error"}],"description":"Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulnerability in which the admin panel may be accessed if hosted on a .dev domain. In order to protect new installations on public servers that don't have an admin account for the Panel yet, we block account registration there by default. This is a security feature, which we implemented years ago in Kirby 2. It helps to avoid that you forget registering your first admin account on a public server. In this case – without our security block – someone else might theoretically be able to find your site, find out it's running on Kirby, find the Panel and then register the account first. It's an unlikely situation, but it's still a certain risk. To be able to register the first Panel account on a public server, you have to enforce the installer via a config setting. This helps to push all users to the best practice of registering your first Panel account on your local machine and upload it together with the rest of the site. This installation block implementation in Kirby versions before 3.3.6 still assumed that .dev domains are local domains, which is no longer true. In the meantime, those domains became publicly available. This means that our installation block is no longer working as expected if you use a .dev domain for your Kirby site. Additionally the local installation check may also fail if your site is behind a reverse proxy. You are only affected if you use a .dev domain or your site is behind a reverse proxy and you have not yet registered your first Panel account on the public server and someone finds your site and tries to login at `yourdomain.dev/panel` before you register your first account. You are not affected if you have already created one or multiple Panel accounts (no matter if on a .dev domain or behind a reverse proxy). The problem has been patched in Kirby 3.3.6. Please upgrade to this or a later version to fix the vulnerability.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":".dev domains treated as local in Kirby","id":"CVE-2020-26253","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"security_feature_bypass","year":"2020"},"n_packages":4,"n_references":5,"next":{"headline":"omniauth-apple allows attacker to fake their email address during authentication","id":"CVE-2020-26254"},"packages":[{"ecosystem":"Packagist","fixed":["3.3.6"],"introduced":["3.0.0"],"last_affected":[],"package":"getkirby/cms","purl":null,"source":"GHSA-2ccx-2gf3-8xvv"},{"ecosystem":"Packagist","fixed":["3.3.6"],"introduced":["3.0.0"],"last_affected":[],"package":"getkirby/cms","purl":"pkg:composer/getkirby/cms","source":"GHSA-2ccx-2gf3-8xvv"},{"ecosystem":"Packagist","fixed":["2.5.14"],"introduced":["0"],"last_affected":[],"package":"getkirby/panel","purl":null,"source":"GHSA-2ccx-2gf3-8xvv"},{"ecosystem":"Packagist","fixed":["2.5.14"],"introduced":["0"],"last_affected":[],"package":"getkirby/panel","purl":"pkg:composer/getkirby/panel","source":"GHSA-2ccx-2gf3-8xvv"}],"prev":{"headline":"Layout XML RCE Vulnerability in OpenMage","id":"CVE-2020-26252"},"products":["kirby"],"published":"2020-12-08","related":[{"cvss_score":8.8,"headline":"Kirby vulnerable to unrestricted file upload of user avatar images","id":"CVE-2024-26483","kev_date_added":null,"published":"2024-02-22"},{"cvss_score":8.1,"headline":"Insufficient permission checks in the language settings in Kirby CMS","id":"CVE-2024-41964","kev_date_added":null,"published":"2024-08-29"},{"cvss_score":7.6,"headline":"Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering","id":"CVE-2026-34587","kev_date_added":null,"published":"2026-04-24"},{"cvss_score":7.6,"headline":"Cross-site scripting (XSS) from unsanitized uploaded SVG files","id":"CVE-2021-29460","kev_date_added":null,"published":"2021-04-27"},{"cvss_score":7.3,"headline":"Kirby vulnerable to Insufficient Session Expiration after a password change","id":"CVE-2023-38489","kev_date_added":null,"published":"2023-07-27"},{"cvss_score":7.3,"headline":"Cross-site scripting (XSS) from writer field content in the site frontend","id":"CVE-2021-41252","kev_date_added":null,"published":"2021-11-16"},{"cvss_score":7.3,"headline":"Cross-site scripting (XSS) from image block content in the site frontend","id":"CVE-2021-41258","kev_date_added":null,"published":"2021-11-16"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-04","vendors":["getkirby"]},"summary":"Attackers can register the first admin account on Kirby CMS sites using .dev domains or behind reverse proxies, bypassing the local installation security block.","url":"https://insights.sbomify.com/CVE-2020-26253/"}