CVE-2024-26482: High severity getkirby Kirby vulnerability
Withdrawn Advisory This advisory has been withdrawn because the vendor reports that some HTML formatting (such as with an H1 element) is allowed, but there is backend sanitization such that the reporter's mentioned "injecting malicious scripts" would not occur.
Original Advisory An HTML injection vulnerability in the Edit Content Layout module of Kirby CMS v4.1.0 allows attackers to execute arbitrary code via a crafted payload.
Other sources
An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is backend sanitization such that the reporter's mentioned "injecting malicious scripts" would not occur.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26482?
The severity of CVE-2024-26482 has been mitigated due to backend sanitization of HTML input as reported by the vendor.
Which versions of software are affected by CVE-2024-26482?
CVE-2024-26482 affects versions of Kirby CMS up to and including 4.1.0.
How do I fix CVE-2024-26482?
There is no fix required for CVE-2024-26482 since the vulnerability has been mitigated by the vendor's backend sanitization.
Can CVE-2024-26482 be exploited?
No, CVE-2024-26482 cannot be exploited due to the implemented backend sanitization that prevents script injection.
Is there a workaround for CVE-2024-26482?
No specific workaround for CVE-2024-26482 is necessary as the vulnerability has been resolved by vendor updates.