-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unescaped output of user-controlled input in the Tags field. Kirby templates that render tag data using direct field output (e.g., <?= $page->tags() ?>) rather than escaped output (<?= $page->tags()->escape() ?>) would execute stored XSS payloads. The core issue lies in the default unescaped string conversion behavior of the Field class, which requires explicit escaping by developers. This matches the vulnerability pattern described, where tag field content isn't properly neutralized before web page generation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| getkirby/starterkit | composer | <= 3.7.0.2 |
PHPPHPOngoing coverage of React2Shell