UpHeron
All vulnerabilities

Servers and applications

CVE-2023-38488

Field injection in the KirbyData text storage handler

Severity
High 8.8
Published
27 Jul 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, 3.9.6
Also known as
GHSA-x5mr-p6v4-wp93
Sources
NVD, Project advisories (GitHub)

Description

Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to update a Kirby content file (e.g. via a contact or comment form). Kirby sites are *not* affected if they don't allow write access for…

Affected software

SoftwareAffected versions
KirbyServers and applications · cpe:a:getkirby:kirby
  • From 3.5.0 before 3.5.8.3
  • From 3.6.0 before 3.6.6.3
  • From 3.7.0 before 3.7.5.2
  • From 3.8.0 before 3.8.4.1
  • From 3.9.0 before 3.9.6
KirbyServers and applications · github:getkirby/kirby
  • From 3.9.0 before 3.9.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-38488
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-38488
  • GitHub Advisory Database https://github.com/advisories/GHSA-x5mr-p6v4-wp93
  • github.com https://github.com/getkirby/kirby/security/advisories/GHSA-x5mr-p6v4-wp93