CVE-2024-26482 Cross-site scripting in n/a
HTML injection in Kirby CMS Edit Content Layout module, though vendor disputes script execution due to backend sanitization.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-26482?
CVE-2024-26482 is a high-severity cross-site scripting vulnerability in n/a, published on 22 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is backend sanitization such that the reporter's mentioned "injecting malicious scripts" would not occur.
Weakness: CWE-80
Which versions are affected by CVE-2024-26482?
It affects 1 product.
Products include Getkirby Kirby.
How do I fix CVE-2024-26482?
No fix published yet.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-26482 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-26482 exists.
Other vulnerabilities in n/a
- CVE-2024-26483 Kirby vulnerable to unrestricted file upload of user avatar images
- CVE-2024-41964 Insufficient permission checks in the language settings in Kirby CMS
- CVE-2026-34587 Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
- CVE-2021-29460 Cross-site scripting (XSS) from unsanitized uploaded SVG files
- CVE-2023-38489 Kirby vulnerable to Insufficient Session Expiration after a password change