UpHeron
All vulnerabilities

Servers and applications

CVE-2021-41258

Cross-site scripting (XSS) from image block content in the site frontend

Severity
Medium 5.4
Published
16 Nov 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.5.8
Also known as
GHSA-cq58-r77c-5jjw
Sources
NVD, Project advisories (GitHub)

Description

Kirby is an open source file structured CMS. In affected versions Kirby's blocks field stores structured data for each block. This data is then used in block snippets to convert the blocks to HTML for use in your templates. We recommend to escape HTML special characters to protect against cross-site scripting (XSS) attacks. The default snippet for the image block unfortunately did not use our…

Affected software

SoftwareAffected versions
KirbyServers and applications · cpe:a:getkirby:kirby
  • From 3.5.0 up to 3.5.7.1
KirbyServers and applications · github:getkirby/kirby
  • From 3.5.0 before 3.5.8

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-41258
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-41258
  • GitHub Advisory Database https://github.com/advisories/GHSA-cq58-r77c-5jjw
  • github.com https://github.com/getkirby/kirby/security/advisories/GHSA-cq58-r77c-5jjw