UpHeron
All vulnerabilities

Servers and applications

CVE-2023-38490

XML External Entity (XXE) vulnerability in the XML data handler

Severity
Critical 10.0
Published
27 Jul 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, 3.9.6
Also known as
GHSA-q386-w6fg-gmgp
Sources
NVD, Project advisories (GitHub)

Description

Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 only affects Kirby sites that use the `Xml` data handler (e.g. `Data::decode($string, 'xml')`) or the `Xml::parse()` method in site or plugin code. The Kirby core does not use any of the affected methods. XML External Entities (XXE) is a little used feature in the XML markup…

Affected software

SoftwareAffected versions
KirbyServers and applications · cpe:a:getkirby:kirby
  • From 3.5.0 before 3.5.8.3
  • From 3.6.0 before 3.6.6.3
  • From 3.7.0 before 3.7.5.2
  • From 3.8.0 before 3.8.4.1
  • From 3.9.0 before 3.9.6
KirbyServers and applications · github:getkirby/kirby
  • From 3.9.0 before 3.9.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-38490
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-38490
  • GitHub Advisory Database https://github.com/advisories/GHSA-q386-w6fg-gmgp
  • github.com https://github.com/getkirby/kirby/security/advisories/GHSA-q386-w6fg-gmgp