{"created":1789562431,"minutes":4320,"value":{"latest":"5.6.0","versions":{"5.6.0":{"status":"latest","description":"Latest Kirby release"},">=5.6.0":{"status":"no-vulnerabilities","description":"No known vulnerabilities"},"5.*":{"status":"active-support","description":"Actively supported","latest":"5.6.0","initialRelease":"2025-06-24","endOfActiveSupport":null,"endOfLife":"2028-06-24"},"4.*":{"status":"security-support","description":"Security support until November 28, 2026","latest":"4.9.6","initialRelease":"2023-11-28","endOfActiveSupport":"2025-06-24","endOfLife":"2026-11-28"},"3.10.*":{"status":"end-of-life","description":"Not supported (end of life) since December 1, 2025","latest":"3.10.1.2","initialRelease":"2023-12-19","endOfActiveSupport":"2023-12-19","endOfLife":"2025-12-01"},"3.9.*":{"status":"end-of-life","description":"Not supported (end of life) since December 1, 2025","latest":"3.10.1.2","initialRelease":"2023-01-17","endOfActiveSupport":"2023-11-28","endOfLife":"2025-12-01"},"3.8.*":{"status":"end-of-life","description":"Not supported (end of life) since December 2, 2024","latest":"3.10.1.2","initialRelease":"2022-10-06","endOfActiveSupport":"2023-01-17","endOfLife":"2024-12-02"},"3.7.*":{"status":"end-of-life","description":"Not supported (end of life) since June 27, 2024","latest":"3.10.1.2","initialRelease":"2022-06-27","endOfActiveSupport":"2022-10-06","endOfLife":"2024-06-27"},"3.6.*":{"status":"end-of-life","description":"Not supported (end of life) since June 27, 2024","latest":"3.10.1.2","initialRelease":"2021-11-16","endOfActiveSupport":"2022-06-27","endOfLife":"2024-06-27"},"3.5.*":{"status":"end-of-life","description":"Not supported (end of life) since November 16, 2023","latest":"3.10.1.2","initialRelease":"2020-12-15","endOfActiveSupport":"2021-11-16","endOfLife":"2023-11-16"},"3.* <3.5":{"status":"end-of-life","description":"Not supported (end of life) since November 16, 2021","latest":"3.10.1.2","initialRelease":"2019-02-05","endOfActiveSupport":"2020-12-15","endOfLife":"2021-11-16"},"2.*":{"status":"end-of-life","description":"Not supported (end of life) since January 1, 2021","latest":"2.5.14","initialRelease":"2014-10-07","endOfActiveSupport":"2019-02-05","endOfLife":"2021-01-01"},"1.*":{"status":"end-of-life","description":"Not supported (end of life) since February 1, 2016","latest":"1.1.2","initialRelease":"2012-01-09","endOfActiveSupport":"2014-10-07","endOfLife":"2016-02-01"}},"urls":{"3.0.0 || 3.5.0 || 3.6.0 || 3.7.0 || 3.8.0 || 3.9.0 || 4.0.0 || 5.0.0":{"changes":"https:\/\/getkirby.com\/releases\/{{ version }}","download":"https:\/\/github.com\/getkirby\/kirby\/archive\/refs\/tags\/{{ version }}.zip","upgrade":"https:\/\/getkirby.com\/releases\/5"},">=3.0.0":{"changes":"https:\/\/github.com\/getkirby\/kirby\/releases\/tag\/{{ version }}","download":"https:\/\/github.com\/getkirby\/kirby\/archive\/refs\/tags\/{{ version }}.zip","upgrade":"https:\/\/getkirby.com\/releases\/5"},"2.*":{"changes":"https:\/\/github.com\/getkirby-v2\/kirby\/releases\/tag\/{{ version }}","download":"https:\/\/github.com\/getkirby-v2\/kirby\/archive\/refs\/tags\/{{ version }}.zip","upgrade":"https:\/\/getkirby.com\/releases\/5"},"1.*":{"changes":"https:\/\/github.com\/getkirby-v1\/starterkit\/releases\/tag\/{{ version }}","upgrade":"https:\/\/getkirby.com\/releases\/5"}},"php":{"8.0":"2023-11-26","8.1":"2025-12-31","8.2":"2026-12-31","8.3":"2027-12-31","8.4":"2028-12-31","8.5":"2029-12-31"},"incidents":[{"affected":"<=4.9.5 || 5.0.0 - 5.5.3","fixed":"4.9.6, 5.6.0","description":"Cross-site scripting (XSS) from language variables that overwrite Kirby's own translations","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-5hwf-w8mw-22c7","severity":"high","score":7.4,"cve":null,"cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:P\/PR:L\/UI:P\/VC:H\/VI:H\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.9.5 || 5.0.0 - 5.5.3","fixed":"4.9.6, 5.6.0","description":"Incomplete URL normalization in the Sane sanitizer for SVG files","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-5h3f-pvr7-cr27","severity":"medium","score":5.1,"cve":null,"cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:P\/VC:N\/VI:N\/VA:N\/SC:L\/SI:N\/SA:L"},{"affected":"<=4.9.5 || 5.0.0 - 5.5.3","fixed":"4.9.6, 5.6.0","description":"Access permissions are not checked when the `files`, `pages` and `users` fields resolve their stored value","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-8r9g-hhm3-5jfh","severity":"high","score":7.1,"cve":null,"cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:N\/VC:H\/VI:N\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.9.5 || 5.0.0 - 5.5.3","fixed":"4.9.6, 5.6.0","description":"Path traversal in the template name during page creation","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-vxp9-82ww-28fg","severity":"high","score":7.1,"cve":null,"cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:N\/VC:N\/VI:H\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.9.5 || 5.0.0 - 5.5.3","fixed":"4.9.6, 5.6.0","description":"Incomplete URL detection in SVG sanitization allows loading of external stylesheets","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-v4xp-j34h-fr2v","severity":"medium","score":5.1,"cve":null,"cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:P\/VC:L\/VI:L\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.9.5 || 5.0.0 - 5.5.3","fixed":"4.9.6, 5.6.0","description":"Cross-site scripting (XSS) from incomplete SVG and XML sanitization in `Dom::sanitize()`","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-45c7-fxc7-4wjh","severity":"high","score":7.4,"cve":null,"cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:P\/PR:L\/UI:P\/VC:H\/VI:H\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.9.5 || 5.0.0 - 5.5.3","fixed":"4.9.6, 5.6.0","description":"Cross-user login through a stale authentication challenge","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-pqmp-prwx-hf35","severity":"high","score":7.6,"cve":null,"cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:P\/PR:L\/UI:N\/VC:H\/VI:H\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.9.5 || 5.0.0 - 5.5.3","fixed":"4.9.6, 5.6.0","description":"Cross-site scripting (XSS) from imported table and iframe HTML in the site frontend","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-grg7-v3qm-gjmm","severity":"high","score":8.5,"cve":null,"cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:P\/VC:H\/VI:H\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.9.5 || 5.0.0 - 5.5.3","fixed":"4.9.6, 5.6.0","description":"Page creation API writes content to an arbitrary path via unfiltered `root` and `dirname` parameters","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-g7p7-x2m4-2h6p","severity":"high","score":7.1,"cve":null,"cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:N\/VC:N\/VI:H\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.9.5 || 5.0.0 - 5.5.3","fixed":"4.9.6, 5.6.0","description":"Path traversal during user creation allows writing account files outside the accounts directory","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-29f4-mjfq-7gph","severity":"high","score":7,"cve":null,"cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:H\/UI:N\/VC:N\/VI:H\/VA:H\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.9.4 || 5.0.0 - 5.5.1","fixed":"4.9.5, 5.5.2","description":"Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-9vx2-j98c-p72w","severity":"high","score":8.2,"cve":"CVE-2026-75594","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:P\/PR:N\/UI:N\/VC:H\/VI:N\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.9.4 || 5.0.0 - 5.5.1","fixed":"4.9.5, 5.5.2","description":"Access to image files outside of the site root via path traversal in the media handling","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-6j4c-mgqr-qv76","severity":"medium","score":6.9,"cve":"CVE-2026-75592","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:P\/PR:N\/UI:N\/VC:N\/VI:N\/VA:N\/SC:H\/SI:N\/SA:N"},{"affected":"5.0.0 - 5.5.1","fixed":"5.5.2","description":"File upload permissions are not checked during processing of chunk data","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-67mx-6wf2-92xp","severity":"high","score":7.1,"cve":"CVE-2026-71415","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:N\/VC:N\/VI:N\/VA:H\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.9.4 || 5.0.0 - 5.5.1","fixed":"4.9.5, 5.5.2","description":"System path exposure from error messages in the REST API","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-rf2p-vh74-7vvh","severity":"medium","score":6.9,"cve":"CVE-2026-69127","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:N\/UI:N\/VC:L\/VI:N\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.9.3 || 5.0.0 - 5.4.3","fixed":"4.9.4, 5.4.4","description":"`pages.access` permission is not checked in the `site\/find` REST API route","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-r3w8-2c5r-h9j9","severity":"high","score":7.1,"cve":"CVE-2026-54005","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:N\/VC:H\/VI:N\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.9.3 || 5.0.0 - 5.4.3","fixed":"4.9.4, 5.4.4","description":"Access to files of top-level drafts is not protected by permissions","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-89cp-7p28-jffg","severity":"medium","score":6.3,"cve":"CVE-2026-54004","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:P\/PR:N\/UI:N\/VC:L\/VI:N\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.9.3 || 5.0.0 - 5.4.3","fixed":"4.9.4, 5.4.4","description":"External Initialization of the Panel on reverse proxy setups with the `Forwarded`, `X-Client-IP` or `X-Real-IP` header","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-whxw-24jc-cwmv","severity":"critical","score":9.1,"cve":"CVE-2026-54003","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:P\/PR:N\/UI:N\/VC:H\/VI:H\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.9.3 || 5.0.0 - 5.4.3","fixed":"4.9.4, 5.4.4","description":"Cross-site scripting (XSS) from incomplete HTML\/XML sanitization in `Dom::sanitize()`","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-wr9h-4r83-f4v6","severity":"high","score":8.5,"cve":"CVE-2026-54002","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:P\/VC:H\/VI:H\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.9.3 || 5.0.0 - 5.4.3","fixed":"4.9.4, 5.4.4","description":"Request header injection in `Http\\Remote`","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-4v4h-m2qq-ppgw","severity":"medium","score":6.9,"cve":"CVE-2026-50188","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:P\/PR:N\/UI:N\/VC:N\/VI:N\/VA:N\/SC:N\/SI:H\/SA:N"},{"affected":"<=4.9.3 || 5.0.0 - 5.4.3","fixed":"4.9.4, 5.4.4","description":"Self cross-site scripting (self-XSS) in the writer field","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-rhj6-r49h-5932","severity":"high","score":7.4,"cve":"CVE-2026-49276","cvss":"CVSS:4.0\/AV:N\/AC:H\/AT:N\/PR:N\/UI:A\/VC:H\/VI:H\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.9.3 || 5.0.0 - 5.4.3","fixed":"4.9.4, 5.4.4","description":"`pages.access` permission is not checked in the pages picker for parent pages","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-23q2-54qv-rq5x","severity":"medium","score":5.3,"cve":"CVE-2026-49274","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:N\/VC:L\/VI:N\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.9.0 || 5.0.0 - 5.4.0","fixed":"4.9.1, 5.4.1","description":"Cross-site scripting (XSS) from links in KirbyTags, image blocks and imported blocks HTML in the site frontend","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-qvjf-922g-pj44","severity":"high","score":8.4,"cve":"CVE-2026-45368","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:A\/VC:H\/VI:H\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.9.0 || 5.0.0 - 5.4.0","fixed":"4.9.1, 5.4.1","description":"Content locks disclose IDs and emails of inaccessible users from `users.access\/list` permissions","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-39vq-49qm-r2mc","severity":"medium","score":5.3,"cve":"CVE-2026-45334","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:N\/VC:L\/VI:N\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"5.3.0 - 5.4.0","fixed":"5.4.1","description":"Pre-authentication path traversal and PHP file inclusion during user lookup","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-9hx7-c53c-v6x8","severity":"high","score":8.8,"cve":"CVE-2026-44177","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:N\/UI:N\/VC:H\/VI:L\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.9.0 || 5.0.0 - 5.4.0","fixed":"4.9.1, 5.4.1","description":"`pages.access` permission is not checked during rendering of page drafts","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-2xw4-v2wx-hqq9","severity":"medium","score":6,"cve":"CVE-2026-44176","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:P\/PR:L\/UI:N\/VC:H\/VI:N\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.9.0 || 5.0.0 - 5.4.0","fixed":"4.9.1, 5.4.1","description":"Cross-site scripting (XSS) from list field content in the site frontend","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-5fhx-9q32-q257","severity":"high","score":8.5,"cve":"CVE-2026-44175","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:P\/VC:H\/VI:H\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.9.0 || 5.0.0 - 5.4.0","fixed":"4.9.1, 5.4.1","description":"Arbitrary Method Call via REST API search and collection query endpoints","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-86rh-h242-j8xp","severity":"high","score":8.7,"cve":"CVE-2026-44174","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:N\/VC:H\/VI:H\/VA:H\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.8.0 || 5.0.0 - 5.3.3","fixed":"4.9.0, 5.4.0","description":"User avatar creation, replacement and deletion are not gated by user update permissions","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-39cp-6679-8xv2","severity":"medium","score":5.3,"cve":"CVE-2026-42174","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:N\/VC:N\/VI:L\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.8.0 || 5.0.0 - 5.3.3","fixed":"4.9.0, 5.4.0","description":"`pages.access\/list` and `files.access\/list` permissions are not consistently checked in the Panel and REST API","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-85x2-r8xv-ww8c","severity":"high","score":7.1,"cve":"CVE-2026-42137","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:N\/VC:H\/VI:N\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.8.0 || 5.0.0 - 5.3.3","fixed":"4.9.0, 5.4.0","description":"Read access to site, user and role information is not gated by permissions","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-2h7v-4372-f6x2","severity":"high","score":7.1,"cve":"CVE-2026-42069","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:N\/VC:H\/VI:N\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.8.0 || 5.0.0 - 5.3.3","fixed":"4.9.0, 5.4.0","description":"System API endpoint leaks installed version and license data to authenticated users","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-x68m-c7jf-2572","severity":"medium","score":5.3,"cve":"CVE-2026-42051","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:N\/VC:L\/VI:N\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.8.0 || 5.0.0 - 5.3.3","fixed":"4.9.0, 5.4.0","description":"Page, file and user creation APIs bypass `create` permission check via unfiltered `blueprint` parameter","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-6gqr-mx34-wh8r","severity":"high","score":7.1,"cve":"CVE-2026-41325","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:N\/VC:N\/VI:H\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.8.0 || 5.0.0 - 5.3.3","fixed":"4.9.0, 5.4.0","description":"Page creation API bypasses `changeStatus` permission check via unfiltered `isDraft` parameter","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-w942-j9r6-hr6r","severity":"medium","score":5.3,"cve":"CVE-2026-40099","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:N\/VC:N\/VI:L\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.8.0 || 5.0.0 - 5.3.3","fixed":"4.9.0, 5.4.0","description":"Server-Side Template Injection (SSTI) via double template resolution in option rendering","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-jcjw-58rv-c452","severity":"high","score":7.6,"cve":"CVE-2026-34587","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:P\/PR:L\/UI:N\/VC:H\/VI:H\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=4.8.0 || 5.0.0 - 5.3.3","fixed":"4.9.0, 5.4.0","description":"XML Injection in the XML creator toolkit","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-9wfj-c55w-j9qr","severity":"medium","score":6.9,"cve":"CVE-2026-32870","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:P\/PR:N\/UI:N\/VC:N\/VI:N\/VA:N\/SC:N\/SI:H\/SA:N"},{"affected":"5.0.0 - 5.2.1","fixed":"5.2.2","description":"Missing permission checks in the content changes API","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-4j78-4xrm-cr2f","severity":"medium","score":5.8,"cve":"CVE-2026-21896","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:P\/PR:L\/UI:A\/VC:N\/VI:H\/VA:L\/SC:N\/SI:N\/SA:N"},{"affected":"5.0.0 - 5.1.3","fixed":"5.1.4","description":"Cross-site scripting (XSS) in the changes dialog","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-84hf-8gh5-575j","severity":"medium","score":5.1,"cve":"CVE-2025-65012","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:P\/VC:L\/VI:L\/VA:N\/SC:N\/SI:N\/SA:N"},{"affected":"<=3.9.8.2 || 3.10.0 - 3.10.1.1 || 4.0.0 - 4.7.0","fixed":"3.9.8.3, 3.10.1.2, 4.7.1","description":"Path traversal of collection names during file system lookup","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-x275-h9j4-7p4h","severity":"medium","score":6.3,"cve":"CVE-2025-31493","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:P\/PR:N\/UI:N\/VC:L\/VI:L\/VA:N\/SC:L\/SI:L\/SA:N"},{"affected":"<=3.9.8.2 || 3.10.0 - 3.10.1.1 || 4.0.0 - 4.7.0","fixed":"3.9.8.3, 3.10.1.2, 4.7.1","description":"Path traversal in the router for PHP's built-in server","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-9p3p-w5jf-8xxg","severity":"low","score":2.3,"cve":"CVE-2025-30207","cvss":"CVSS:4.0\/AV:A\/AC:L\/AT:P\/PR:N\/UI:N\/VC:N\/VI:N\/VA:N\/SC:L\/SI:N\/SA:N"},{"affected":"<=3.9.8.2 || 3.10.0 - 3.10.1.1 || 4.0.0 - 4.7.0","fixed":"3.9.8.3, 3.10.1.2, 4.7.1","description":"Path traversal of snippet names during file system lookup","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-fw82-87p8-v6hp","severity":"medium","score":6.3,"cve":"CVE-2025-30159","cvss":"CVSS:4.0\/AV:N\/AC:L\/AT:P\/PR:N\/UI:N\/VC:L\/VI:L\/VA:N\/SC:L\/SI:L\/SA:N"},{"affected":"<=3.6.6.5 || 3.7.0 - 3.7.5.4 || 3.8.0 - 3.8.4.3 || 3.9.0 - 3.9.8.1 || 3.10.0 - 3.10.1 || 4.0.0 - 4.3.0","fixed":"3.6.6.6, 3.7.5.5, 3.8.4.4, 3.9.8.2, 3.10.1.1, 4.3.1","description":"Insufficient permission checks in the language settings","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-jm9m-rqr3-wfmh","severity":"high","score":8.1,"cve":"CVE-2024-41964","cvss":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:H\/A:H"},{"affected":"4.0.0 - 4.1.0","fixed":"4.1.1","description":"Cross-site scripting (XSS) in the link field \"Custom\" type","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-63h4-w25c-3qv4","severity":"medium","score":4.6,"cve":"CVE-2024-27087","cvss":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:U\/C:L\/I:L\/A:N"},{"affected":"<=3.6.6.4 || 3.7.0 - 3.7.5.3 || 3.8.0 - 3.8.4.2 || 3.9.0 - 3.9.8 || 3.10.0 || 4.0.0 - 4.1.0","fixed":"3.6.6.5, 3.7.5.4, 3.8.4.3, 3.9.8.1, 3.10.0.1, 4.1.1","description":"Unrestricted file upload of user avatar images","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-xrvh-rvc4-5m43","severity":"medium","score":4.6,"cve":"CVE-2024-26483","cvss":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:U\/C:L\/I:L\/A:N"},{"affected":"<=3.6.6.4 || 3.7.0 - 3.7.5.3 || 3.8.0 - 3.8.4.2 || 3.9.0 - 3.9.8 || 3.10.0 || 4.0.0 - 4.1.0","fixed":"3.6.6.5, 3.7.5.4, 3.8.4.3, 3.9.8.1, 3.10.0.1, 4.1.1","description":"Self cross-site scripting (self-XSS) in the URL field","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-57f2-8p89-66x6","severity":"medium","score":4.2,"cve":"CVE-2024-26481","cvss":"CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:R\/S:U\/C:L\/I:L\/A:N"},{"affected":"<=3.5.8.2 || 3.6.0 - 3.6.6.2 || 3.7.0 - 3.7.5.1 || 3.8.0 - 3.8.4 || 3.9.0 - 3.9.5","fixed":"3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, 3.9.6","description":"Denial of service from unlimited password lengths","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-3v6j-v3qc-cxff","severity":"medium","score":5.3,"cve":"CVE-2023-38492","cvss":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:N\/A:L"},{"affected":"<=3.5.8.2 || 3.6.0 - 3.6.6.2 || 3.7.0 - 3.7.5.1 || 3.8.0 - 3.8.4 || 3.9.0 - 3.9.5","fixed":"3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, 3.9.6","description":"Cross-site scripting (XSS) from MIME type auto-detection of uploaded files","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-8fv7-wq38-f5c9","severity":"medium","score":5.7,"cve":"CVE-2023-38491","cvss":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:U\/C:H\/I:N\/A:N"},{"affected":"<=3.5.8.2 || 3.6.0 - 3.6.6.2 || 3.7.0 - 3.7.5.1 || 3.8.0 - 3.8.4 || 3.9.0 - 3.9.5","fixed":"3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, 3.9.6","description":"XML External Entity (XXE) vulnerability in the XML data handler","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-q386-w6fg-gmgp","severity":"medium","score":6.8,"cve":"CVE-2023-38490","cvss":"CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:N\/S:C\/C:H\/I:N\/A:N"},{"affected":"<=3.5.8.2 || 3.6.0 - 3.6.6.2 || 3.7.0 - 3.7.5.1 || 3.8.0 - 3.8.4 || 3.9.0 - 3.9.5","fixed":"3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, 3.9.6","description":"Insufficient Session Expiration after a password change","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-5mvj-rvp8-rf45","severity":"high","score":7.3,"cve":"CVE-2023-38489","cvss":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:U\/C:H\/I:H\/A:N"},{"affected":"<=3.5.8.2 || 3.6.0 - 3.6.6.2 || 3.7.0 - 3.7.5.1 || 3.8.0 - 3.8.4 || 3.9.0 - 3.9.5","fixed":"3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, 3.9.6","description":"Field injection in the KirbyData text storage handler","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-x5mr-p6v4-wp93","severity":"high","score":7.1,"cve":"CVE-2023-38488","cvss":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:H\/A:L"},{"affected":"<=3.5.8.1 || 3.6.0 - 3.6.6.1 || 3.7.0 - 3.7.5 || 3.8.0","fixed":"3.5.8.2, 3.6.6.2, 3.7.5.1, 3.8.1","description":"User enumeration in the brute force protection","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-c27j-76xg-6x4f","severity":"medium","score":6.5,"cve":"CVE-2022-39315","cvss":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:L\/A:N"},{"affected":"3.5.0 - 3.5.8.1 || 3.6.0 - 3.6.6.1 || 3.7.0 - 3.7.5 || 3.8.0","fixed":"3.5.8.2, 3.6.6.2, 3.7.5.1, 3.8.1","description":"User enumeration in the code-based login and password reset forms","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-43qq-qw4x-28f8","severity":"medium","score":4.8,"cve":"CVE-2022-39314","cvss":"CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:N\/S:U\/C:L\/I:L\/A:N"},{"affected":"<=3.5.8","fixed":"3.5.8.1","description":"Cross-site scripting (XSS) from dynamic options in the multiselect field","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-3f89-869f-5w76","severity":"medium","score":5.9,"cve":"CVE-2022-36037","cvss":"CVSS:3.1\/AV:N\/AC:H\/PR:L\/UI:N\/S:U\/C:H\/I:L\/A:N"},{"affected":"3.5.7 - 3.5.8 || 3.6.0 - 3.6.6 || 3.7.0 - 3.7.3","fixed":"3.5.8.1, 3.6.6.1, 3.7.4","description":"Cross-site scripting (XSS) from content entered in the tags and multiselect fields","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-rv3r-vqjj-8c76","severity":"high","score":7.1,"cve":"CVE-2022-35174","cvss":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:L\/A:N"},{"affected":"3.5.0 - 3.5.7.1","fixed":"3.5.8","description":"Cross-site scripting (XSS) from image block content in the site frontend","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-cq58-r77c-5jjw","severity":"medium","score":5.4,"cve":"CVE-2021-41258","cvss":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:L\/A:N"},{"affected":"3.5.0 - 3.5.7.1","fixed":"3.5.8","description":"Cross-site scripting (XSS) from writer field content in the site frontend","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-x7j7-qp7j-hw3q","severity":"medium","score":5.4,"cve":"CVE-2021-41252","cvss":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:L\/A:N"},{"affected":"<=3.5.6","fixed":"3.5.7","description":"Cross-site scripting (XSS) from field and configuration text displayed in the Panel","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-2f2w-349x-vrqm","severity":"high","score":7.1,"cve":"CVE-2021-32735","cvss":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:L\/A:N"},{"affected":"<=3.5.3.1","fixed":"3.5.4","description":"Cross-site scripting (XSS) from unvalidated uploaded SVG or XML files","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-qgp4-5qx6-548g","severity":"high","score":7.6,"cve":"CVE-2021-29460","cvss":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:H\/I:L\/A:N"},{"affected":"<=2.5.13 || 3.0.0 - 3.4.4","fixed":"2.5.14, 3.4.5","description":"Remote code execution (RCE) from PHP Phar archives uploaded by Panel users as content files","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-g3h8-cg9x-47qw","severity":"critical","score":9.9,"cve":"CVE-2020-26255","cvss":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:H\/I:H\/A:H"},{"affected":"<=2.5.13 || 3.0.0 - 3.3.5","fixed":"2.5.14, 3.3.6","description":"External Initialization of the Panel on .dev domains and some reverse proxy setups","link":"https:\/\/github.com\/getkirby\/kirby\/security\/advisories\/GHSA-2ccx-2gf3-8xvv","severity":"medium","score":6.5,"cve":"CVE-2020-26253","cvss":"CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:N\/S:U\/C:L\/I:H\/A:N"}],"messages":[],"_version":"5.5.3"}}