Remote Code Execution Vulnerability in Kirby CMS by GetKirby
CVE-2026-45368

8.4HIGH

Key Information:

Vendor

Getkirby

Status
Kirby
Vendor
CVE Published:
16 July 2026

What is CVE-2026-45368?

Kirby CMS, a popular open-source content management system, has a vulnerability in its URL handling for KirbyTags and image blocks that allows for remote code execution. This security issue is present in versions prior to 4.9.1 and 5.4.1, where unfiltered malicious URLs can lead to the execution of arbitrary scripts. The affected components include various first-party Kirby renderers that generate HTML links from user-supplied content. While certain URL formats were initially blocked, advanced attack vectors leveraging URLs like 'javascript://x%0A…' remain unprotected. Other harmful schemes such as 'vbscript:', 'data:', and 'livescript:' are also at risk. Users are strongly urged to upgrade to patched versions to mitigate this risk.

Affected Version(s)

kirby < 4.9.1 < 4.9.1

kirby >= 5.0.0, < 5.4.1 < 5.0.0, 5.4.1

References

https://github.com/getkirby/kirby/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/getkirby/kirby/releases/tag/5.4.1
x_refsource_MISC

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.