← All advisories

Medium severity4.7NVD Advisory· Published Feb 22, 2024· Updated Jun 17, 2026

CVE-2024-26481

CVE-2024-26481

Description

Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
getkirby/cmsPackagist	< 3.6.6.5	3.6.6.5
getkirby/cmsPackagist	>= 3.7.0, < 3.7.5.4	3.7.5.4
getkirby/cmsPackagist	>= 3.8.0, < 3.8.4.3	3.8.4.3
getkirby/cmsPackagist	>= 3.9.0, < 3.9.8.1	3.9.8.1
getkirby/cmsPackagist	>= 3.10.0, < 3.10.0.1	3.10.0.1
getkirby/cmsPackagist	>= 4.0.0, < 4.1.1	4.1.1

Affected products

4

Getkirby/Kirby2 versions
cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*range: <3.6.6.5
- cpe:2.3:a:getkirby:kirby:3.10.0:*:*:*:*:*:*:*
Kirby/CMSdescription
ghsa-coords
pkg:composer/getkirby/cms
Range: < 3.6.6.5

Patches

Vulnerability mechanics

References

4

shrouded-trowel-50c.notion.site/Kirby-CMS-4-1-0-Self-Cross-Site-Scripting-d877183d20af49f8a8f58554bc06d51cnvdExploitThird Party AdvisoryWEB
github.com/advisories/GHSA-57f2-8p89-66x6ghsaADVISORY
github.com/getkirby/kirby/security/advisories/GHSA-57f2-8p89-66x6nvdThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2024-26481ghsaADVISORY

News mentions

0

No linked articles in our index yet.