{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/tags/kirby/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["cms"],"_cs_severities":["high"],"_cs_tags":["ssti","kirby","template-injection"],"_cs_type":"advisory","_cs_vendors":["getkirby"],"content_html":"\u003cp\u003eA server-side template injection (SSTI) vulnerability has been identified in Kirby CMS affecting sites using option fields (checkboxes, color, multiselect, select, radio, tags, or toggles) with options sourced from queries or APIs where the values cannot be fully trusted. This vulnerability, discovered and reported by @offset, stems from a double resolution of templates within the options rendering logic. An attacker with Panel access or through user interaction can inject malicious query templates. This can lead to unauthorized access to sensitive information (like user passwords) or malicious modification of site content. The vulnerability affects Kirby CMS versions prior to 4.9.0 and versions between 5.0.0 and 5.4.0.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains access to the Kirby Panel, or convinces a user with access to interact with a malicious element.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies a page or blueprint using dynamic options for form fields (checkboxes, selects, etc.) sourced from a query or API.\u003c/li\u003e\n\u003cli\u003eThe attacker injects a malicious query template, such as \u003ccode\u003e{{ users.first.password }}\u003c/code\u003e or \u003ccode\u003e{{ page.delete }}\u003c/code\u003e, into a page title or data returned from an external API.\u003c/li\u003e\n\u003cli\u003eThe administrator or another privileged user navigates to the affected Panel view, triggering the rendering of the form field with the injected malicious template.\u003c/li\u003e\n\u003cli\u003eThe Kirby CMS options logic improperly double-resolves the template, executing the injected query.\u003c/li\u003e\n\u003cli\u003eThe attacker gains access to sensitive information, such as user passwords, or triggers unauthorized actions like page deletion, depending on the injected query.\u003c/li\u003e\n\u003cli\u003eThe attacker escalates privileges by exploiting the compromised user\u0026rsquo;s session or by directly accessing sensitive information.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability could allow attackers to access sensitive site information, such as user credentials, or perform unauthorized actions, like modifying or deleting content. This could lead to a complete compromise of the Kirby CMS website and its data. The vulnerability specifically targets sites that leverage dynamic options for form fields, making them susceptible to malicious query injection. Sites running vulnerable versions of Kirby CMS are at risk of information disclosure and unauthorized modification.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to Kirby CMS version 4.9.0 or 5.4.0 or later to patch the vulnerability as described in the advisory (\u003ca href=\"https://github.com/advisories/GHSA-jcjw-58rv-c452\"\u003ehttps://github.com/advisories/GHSA-jcjw-58rv-c452\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eApply input validation and sanitization to all data sources used for dynamic options to prevent the injection of malicious templates and mitigate CVE-2026-34587.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious activity, such as requests containing template syntax or attempts to access sensitive information, to identify potential exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-23T21:24:37Z","date_published":"2026-04-23T21:24:37Z","id":"/briefs/2026-04-kirby-ssti/","summary":"A server-side template injection (SSTI) vulnerability exists in Kirby CMS within the option rendering feature due to double template resolution in option fields (checkboxes, color, multiselect, select, radio, tags, or toggles) when using options from a query or API with untrusted values, potentially allowing attackers to inject malicious queries.","title":"Kirby CMS Server-Side Template Injection via Double Template Resolution","url":"https://feed.craftedsignal.io/briefs/2026-04-kirby-ssti/"}],"language":"en","title":"CraftedSignal Threat Feed — Kirby","version":"https://jsonfeed.org/version/1.1"}