UpHeron
All vulnerabilities

Servers and applications

CVE-2025-65012

Cross-site scripting (XSS) in the changes dialog

Severity
Medium 5.1
Published
18 Nov 2025
Last changed
18 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
5.1.4
Also known as
GHSA-84hf-8gh5-575j
Sources
NVD, Project advisories (GitHub)

Description

Kirby is an open-source content management system. From versions 5.0.0 to 5.1.3, attackers could change the title of any page or the name of any user to a malicious string. Then they could modify any content field of the same model without saving, making the model a candidate for display in the "Changes" dialog. If another authenticated user subsequently opened the dialog in their Panel, the…

Affected software

SoftwareAffected versions
KirbyServers and applications · cpe:a:getkirby:kirby
  • From 5.0.0 before 5.1.4
KirbyServers and applications · github:getkirby/kirby
  • From 5.0.0 before 5.1.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-65012
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-65012
  • GitHub Advisory Database https://github.com/advisories/GHSA-84hf-8gh5-575j
  • github.com https://github.com/getkirby/kirby/security/advisories/GHSA-84hf-8gh5-575j