Kirby vulnerable to field injection in the KirbyData text storage handler
CVE-2023-38488
7.1HIGH
What is CVE-2023-38488?
The vulnerability in Kirby allows attackers, particularly those with write access to the content system, to inject malicious content or alter site data. This occurs due to a flaw in how Kirby handles field separators when reading and writing content data. By exploiting this issue, attackers can potentially override important fields in content files, leading to unintended modifications or execution of malicious code. The issue has been patched in versions 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6, ensuring improved security against such manipulations.
Affected Version(s)
kirby < 3.5.8.3 < 3.5.8.3
kirby >= 3.6.0, < 3.6.6.3 < 3.6.0, 3.6.6.3
kirby >= 3.7.0, < 3.7.5.2 < 3.7.0, 3.7.5.2