CVE-2025-65012
BaseFortify
Publication date: 2025-11-18
Last updated on: 2025-11-26
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| getkirby | kirby | From 5.0.0 (inc) to 5.1.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Kirby CMS versions 5.0.0 to 5.1.3 allows attackers who have authenticated Panel user access to change the title of any page or the name of any user to a malicious string. They can then modify any content field of the same model without saving, causing the model to appear in the 'Changes' dialog. When another authenticated user opens this dialog in their Panel, the malicious code executes. The attack requires interaction by another Panel user and cannot be automated. It has been fixed in version 5.1.4.
How can this vulnerability impact me? :
This vulnerability can lead to the execution of malicious code within the Kirby Panel when another authenticated user views the 'Changes' dialog containing the manipulated content. This could result in unauthorized actions or compromise of the Panel user's session or data. It affects sites that have authenticated Panel users or allow external visitors to update page titles or usernames, potentially leading to security risks within the content management environment.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade Kirby to version 5.1.4 or later, where this issue has been patched. Additionally, restrict the group of authenticated Panel users to trusted individuals only and avoid allowing external visitors to update page titles or usernames to reduce risk.