UpHeron
All vulnerabilities

Servers and applications

CVE-2021-32735

Cross-site scripting (XSS) from field and configuration text displayed in the Panel

Severity
Medium 5.4
Published
2 Jul 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.5.7
Also known as
GHSA-2f2w-349x-vrqm
Sources
NVD, Project advisories (GitHub)

Description

Kirby is a content management system. In Kirby CMS versions 3.5.5 and 3.5.6, the Panel's `ListItem` component (used in the pages and files section for example) displayed HTML in page titles as it is. This could be used for cross-site scripting (XSS) attacks. Malicious authenticated Panel users can escalate their privileges if they get access to the Panel session of an admin user. Visitors…

Affected software

SoftwareAffected versions
KirbyServers and applications · cpe:a:getkirby:kirby
  • Every version before 3.5.7
KirbyServers and applications · github:getkirby/kirby
  • Every version before 3.5.7

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-32735
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-32735
  • GitHub Advisory Database https://github.com/advisories/GHSA-2f2w-349x-vrqm
  • github.com https://github.com/getkirby/kirby/security/advisories/GHSA-2f2w-349x-vrqm