UpHeron
All vulnerabilities

Servers and applications

CVE-2023-38491

Cross-site scripting (XSS) from MIME type auto-detection of uploaded files

Severity
Medium 5.4
Published
27 Jul 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, 3.9.6
Also known as
GHSA-8fv7-wq38-f5c9
Sources
NVD, Project advisories (GitHub)

Description

Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to upload an arbitrary file to the content folder. Kirby sites are not affected if they don't allow file uploads for untrusted users or…

Affected software

SoftwareAffected versions
KirbyServers and applications · cpe:a:getkirby:kirby
  • From 3.5.0 before 3.5.8.3
  • From 3.6.0 before 3.6.6.3
  • From 3.7.0 before 3.7.5.2
  • From 3.8.0 before 3.8.4.1
  • From 3.9.0 before 3.9.6
KirbyServers and applications · github:getkirby/kirby
  • From 3.9.0 before 3.9.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-38491
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-38491
  • GitHub Advisory Database https://github.com/advisories/GHSA-8fv7-wq38-f5c9
  • github.com https://github.com/getkirby/kirby/security/advisories/GHSA-8fv7-wq38-f5c9