Skip to content
Fencer Vulns
high 7.1

CVE-2024-26482 json

Withdrawn Advisory: Kirby CMS HTML injection vulnerability

published 2024-02-22 2 y ago modified 2026-09-10 1 mo ago also GHSA-qv4x-v2v4-f8p9 , EUVD-2024-0703

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 25%
public exploits
0
none known

Summary

An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is backend sanitization such that the reporter's mentioned "injecting malicious scripts" would not occur.

Patch / fix

  • dtb-aarch64 openSUSE Leap 15.6 6.4.0-150600.23.14.1
  • kernel-64kb SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 6.4.0-150600.23.14.1
  • kernel-syms SLE Module for Development Tools 15 SP6, openSUSE Leap 15.6 6.4.0-150600.23.14.2
  • kernel-obs-qa openSUSE Leap 15.6 6.4.0-150600.23.14.2
  • kernel-source SLE Module for Development Tools 15 SP6, SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 6.4.0-150600.23.14.2
  • kernel-default SLE Workstation Extension 15 SP6, SLE Module for Legacy 15 SP6, SLE Module for Basesystem 15 SP6 +3 more 6.4.0-150600.23.14.2
  • kernel-kvmsmall openSUSE Leap 15.6 6.4.0-150600.23.14.2
  • kernel-zfcpdump SLE Module for Basesystem 15 SP6, openSUSE Leap 15.6 6.4.0-150600.23.14.2

suse advisories SUSE-SU-2024:2571-1

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • shrouded-trowel-50c.notion.site https://shrouded-trowel-50c.notion.site/Kirby-CMS-4-1-0-HTML-Injection-19ca19686d0a4533ab4b0c53fc977eef?pvs=4 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CNA 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Affected products

  • kirby kirby_cms

Classification

Weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.