CVE-2026-32870

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32870", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-16T21:03:44.419Z", "datePublished": "2026-04-24T00:19:13.544Z", "dateUpdated": "2026-04-24T16:30:09.611Z"}, "containers": {"cna": {"title": "Kirby has XML injection in its XML creator toolkit", "problemTypes": [{"descriptions": [{"cweId": "CWE-91", "lang": "en", "description": "CWE-91: XML Injection (aka Blind XPath Injection)", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/getkirby/kirby/security/advisories/GHSA-9wfj-c55w-j9qr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-9wfj-c55w-j9qr"}, {"name": "https://github.com/getkirby/kirby/releases/tag/4.9.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/getkirby/kirby/releases/tag/4.9.0"}, {"name": "https://github.com/getkirby/kirby/releases/tag/5.4.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/getkirby/kirby/releases/tag/5.4.0"}], "affected": [{"vendor": "getkirby", "product": "kirby", "versions": [{"version": "< 4.9.0", "status": "affected"}, {"version": ">= 5.0.0, < 5.4.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T00:19:13.544Z"}, "descriptions": [{"lang": "en", "value": "Kirby is an open-source content management system. Kirby's `Xml::value()` method has special handling for `<![CDATA[ ]]>` blocks. If the input value is already valid `CDATA`, it is not escaped a second time but allowed to pass through. However, prior to versions 4.9.0 and 5.4.0, it was possible to trick this check into allowing values that only contained a valid `CDATA` block but also contained other structured data outside of the `CDATA` block. This structured data would then also be allowed to pass through, circumventing the value protection. The `Xml::value()` method is used in `Xml::tag()`, `Xml::create()` and in the `Xml` data handler (e.g. `Data::encode($string, 'xml')`). Both the vulnerable methods and the data handler are not used in the Kirby core. However they may be used in site or plugin code, e.g. to create XML strings from input data. If those generated files are passed to another implementation that assigns specific meaning to the XML schema, manipulation of this system's behavior is possible. Kirby sites that don't use XML generation in site or plugin code are not affected. The problem has been patched in Kirby 4.9.0 and Kirby 5.4.0. In all of the mentioned releases, Kirby has added additional checks that only allow unchanged `CDATA` passthrough if the entire string is made up of valid `CDATA` blocks and no structured data. This protects all uses of the method against the described vulnerability."}], "source": {"advisory": "GHSA-9wfj-c55w-j9qr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-24T16:29:59.845471Z", "id": "CVE-2026-32870", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-24T16:30:09.611Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32870", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-24T16:29:59.845471Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-24T16:30:06.402Z"}}], "cna": {"title": "Kirby has XML injection in its XML creator toolkit", "source": {"advisory": "GHSA-9wfj-c55w-j9qr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "getkirby", "product": "kirby", "versions": [{"status": "affected", "version": "< 4.9.0"}, {"status": "affected", "version": ">= 5.0.0, < 5.4.0"}]}], "references": [{"url": "https://github.com/getkirby/kirby/security/advisories/GHSA-9wfj-c55w-j9qr", "name": "https://github.com/getkirby/kirby/security/advisories/GHSA-9wfj-c55w-j9qr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/getkirby/kirby/releases/tag/4.9.0", "name": "https://github.com/getkirby/kirby/releases/tag/4.9.0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/getkirby/kirby/releases/tag/5.4.0", "name": "https://github.com/getkirby/kirby/releases/tag/5.4.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Kirby is an open-source content management system. Kirby's `Xml::value()` method has special handling for `<![CDATA[ ]]>` blocks. If the input value is already valid `CDATA`, it is not escaped a second time but allowed to pass through. However, prior to versions 4.9.0 and 5.4.0, it was possible to trick this check into allowing values that only contained a valid `CDATA` block but also contained other structured data outside of the `CDATA` block. This structured data would then also be allowed to pass through, circumventing the value protection. The `Xml::value()` method is used in `Xml::tag()`, `Xml::create()` and in the `Xml` data handler (e.g. `Data::encode($string, 'xml')`). Both the vulnerable methods and the data handler are not used in the Kirby core. However they may be used in site or plugin code, e.g. to create XML strings from input data. If those generated files are passed to another implementation that assigns specific meaning to the XML schema, manipulation of this system's behavior is possible. Kirby sites that don't use XML generation in site or plugin code are not affected. The problem has been patched in Kirby 4.9.0 and Kirby 5.4.0. In all of the mentioned releases, Kirby has added additional checks that only allow unchanged `CDATA` passthrough if the entire string is made up of valid `CDATA` blocks and no structured data. This protects all uses of the method against the described vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-91", "description": "CWE-91: XML Injection (aka Blind XPath Injection)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T00:19:13.544Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32870", "state": "PUBLISHED", "dateUpdated": "2026-04-24T16:30:09.611Z", "dateReserved": "2026-03-16T21:03:44.419Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-24T00:19:13.544Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kirby", "vendor": "getkirby", "versions": [{"status": "affected", "version": "< 4.9.0"}, {"status": "affected", "version": ">= 5.0.0, < 5.4.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*", "matchCriteriaId": "1BB5394F-37F9-4A53-9CE7-79548F674886", "versionEndExcluding": "4.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*", "matchCriteriaId": "B2D943B9-CD71-45FE-A1A4-158603C3502E", "versionEndExcluding": "5.4.0", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kirby is an open-source content management system. Kirby's `Xml::value()` method has special handling for `<![CDATA[ ]]>` blocks. If the input value is already valid `CDATA`, it is not escaped a second time but allowed to pass through. However, prior to versions 4.9.0 and 5.4.0, it was possible to trick this check into allowing values that only contained a valid `CDATA` block but also contained other structured data outside of the `CDATA` block. This structured data would then also be allowed to pass through, circumventing the value protection. The `Xml::value()` method is used in `Xml::tag()`, `Xml::create()` and in the `Xml` data handler (e.g. `Data::encode($string, 'xml')`). Both the vulnerable methods and the data handler are not used in the Kirby core. However they may be used in site or plugin code, e.g. to create XML strings from input data. If those generated files are passed to another implementation that assigns specific meaning to the XML schema, manipulation of this system's behavior is possible. Kirby sites that don't use XML generation in site or plugin code are not affected. The problem has been patched in Kirby 4.9.0 and Kirby 5.4.0. In all of the mentioned releases, Kirby has added additional checks that only allow unchanged `CDATA` passthrough if the entire string is made up of valid `CDATA` blocks and no structured data. This protects all uses of the method against the described vulnerability."}, {"lang": "es", "value": "Kirby es un sistema de gesti\u00f3n de contenidos de c\u00f3digo abierto. El m\u00e9todo \u201cXml::value()\u201d de Kirby tiene un manejo especial para los bloques \u201c<![CDATA[ ]]>\u201d. Si el valor de entrada ya es \u201cCDATA\u201d v\u00e1lido, no se escapa una segunda vez, sino que se permite su paso. Sin embargo, antes de las versiones 4.9.0 y 5.4.0, era posible enga\u00f1ar a esta comprobaci\u00f3n para que permitiera valores que solo conten\u00edan un bloque \u201cCDATA\u201d v\u00e1lido, pero que tambi\u00e9n conten\u00edan otros datos estructurados fuera del bloque \u201cCDATA\u201d. Estos datos estructurados tambi\u00e9n se permitir\u00edan pasar, eludiendo la protecci\u00f3n del valor. El m\u00e9todo \u201cXml::value()\u201d se utiliza en \u201cXml::tag()\u201d, \u201cXml::create()\u201d y en el gestor de datos \u201cXml\u201d (por ejemplo, \u201cData::encode($string, \u2019xml\u2019)\u201d). Tanto los m\u00e9todos vulnerables como el gestor de datos no se utilizan en el n\u00facleo de Kirby. Sin embargo, pueden utilizarse en el c\u00f3digo del sitio o del plugin, por ejemplo, para crear cadenas XML a partir de datos de entrada. Si esos archivos generados se pasan a otra implementaci\u00f3n que asigna un significado espec\u00edfico al esquema XML, es posible la manipulaci\u00f3n del comportamiento de este sistema. Los sitios de Kirby que no utilizan la generaci\u00f3n de XML en el c\u00f3digo del sitio o del plugin no se ven afectados. El problema ha sido parcheado en Kirby 4.9.0 y Kirby 5.4.0. En todas las versiones mencionadas, Kirby ha a\u00f1adido comprobaciones adicionales que solo permiten el paso de \u201cCDATA\u201d sin cambios si la cadena completa est\u00e1 compuesta por bloques \u201cCDATA\u201d v\u00e1lidos y no hay datos estructurados. Esto protege todos los usos del m\u00e9todo contra la vulnerabilidad descrita."}], "id": "CVE-2026-32870", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32870", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-24T16:29:59.845471Z", "version": "2.0.3"}}]}, "published": "2026-04-24T01:16:11.953", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/getkirby/kirby/releases/tag/4.9.0"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/getkirby/kirby/releases/tag/5.4.0"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-9wfj-c55w-j9qr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-91"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.9.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.4.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "inferred", "scores": [{"score": 100.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "kirby", "source": "cna", "vendor": "getkirby"}, "product": "kirby", "vendor": "getkirby"}], "analysis": {"en": {"generated_at": "2026-04-28T20:25:49.057310+00:00", "value": {"mitigation_remediation": ["Upgrade to Kirby 4.9.0 or later, or to 5.4.0 or later, to apply the patched CDATA validation checks.", "Identify any plugin or custom code that calls Xml::value(), Xml::tag(), Xml::create(), or Data::encode() with 'xml', and ensure they only process trusted or properly sanitized input.", "Validate the resulting XML string before passing it to downstream systems, confirming it contains only CDATA blocks and no extraneous XML structure."], "summary": {"action": "Immediate Patch", "impact": "XML Injection"}, "threat_synthesis": {"affected_systems": "The problem exists in Kirby CMS versions prior to 4.9.0 in the 4.x series and prior to 5.4.0 in the 5.x series. It only affects sites or plugins that use the vulnerable XML creation utilities\u2014Xml::tag(), Xml::create(), or Data::encode() with the 'xml' type. Sites that do not generate XML within their environment are not vulnerable.", "description_and_impact": "Kirby's Xml::value() method improperly handles CDATA boilerplate when the input contains a valid CDATA section combined with extraneous XML markup. The flaw, a CWE\u201191 weakness, allows attacker supplied input to bypass escaping and embed arbitrary XML fragments into output generated by site or plugin code. This could result in content tampering or manipulation of downstream systems that parse the flawed output.", "risk_and_exploitability": "The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1% suggests low likelihood of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. Exploitation would require an attacker to supply crafted input to the vulnerable XML functions, likely through a user\u2011facing form or a malicious plugin. The likely attack vector is an untrusted input channel that reaches these XML helpers. If an attacker succeeds, they can inject XML elements that downstream consumers might trust, leading to data corruption or privilege escalation within those workflows."}}}}, "created": "2026-04-27T22:00:15.588336+00:00", "updated": "2026-04-28T20:30:06.190863+00:00", "vendors": ["getkirby", "getkirby$PRODUCT$kirby"]}