Attack Chain

1. An attacker gains authenticated access to the Kirby Panel with update permissions.
2. The attacker identifies a page or content structure that utilizes a ’list’ field or ‘blocks’ field with the ’list’ block.
3. The attacker crafts a malicious payload containing JavaScript code embedded within HTML tags.
4. The attacker injects the malicious payload into the ’list’ field content, either directly via API or through the Panel’s editing interface.
5. The attacker saves the modified content. The injected payload is stored within the content files on the server.
6. A user (either another authenticated user or an unauthenticated visitor) requests the page containing the affected ’list’ field on the site frontend.
7. The server renders the page, including the injected malicious HTML code from the ’list’ field.
8. The user’s browser executes the injected JavaScript code, potentially leading to session hijacking, data theft, or other malicious actions.

Impact

Successful exploitation of this XSS vulnerability (CVE-2026-44175) allows an attacker to execute arbitrary JavaScript code in the context of a user’s browser session. This can lead to credential theft, session hijacking, defacement of the website, or redirection to malicious sites. The impact is high severity, as it affects all Kirby sites using the list field when content is authored by users who may not be fully trusted. The number of victims depends on the number of affected sites and the frequency with which users access pages containing the injected payload.

Recommendation

• Upgrade to Kirby CMS version 4.9.1 or 5.4.1 or later to apply the patch that sanitizes list field content, mitigating the XSS vulnerability (CVE-2026-44175).
• Implement strict input validation and output encoding mechanisms on all user-supplied data within the Kirby CMS environment.
• Review existing content for potentially malicious code within list fields and sanitize the content.
• Deploy a Web Application Firewall (WAF) with rules to detect and block XSS attacks targeting Kirby CMS, specifically focusing on the ’list’ field and ‘blocks’ field inputs.
• Enable logging for all API requests to the Kirby Panel to monitor for suspicious activity and potential payload injections.