GHSA-2f2w-349x-vrqm is a high-severity (CVSS 7.1) CWE-80 vulnerability in getkirby/cms. O3 Security confirms whether GHSA-2f2w-349x-vrqm is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
Cross-site scripting (XSS) from field and configuration text displayed in the Panel
Real-World Exposure
getkirby/cmsReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
On Saturday, @hdodov reported that the Panel's ListItem component (used in the pages and files section for example) displayed HTML in page titles as it is. This could be used for cross-site scripting (XSS) attacks.
We used his report as an opportunity to find and fix XSS issues related to dynamic site content throughout the Panel codebase.
Impact
Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the Panel session of other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim.
Such vulnerabilities are critical if you might have potential attackers in your group of authenticated Panel users. They can escalate their privileges if they get access to the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible.
Visitors without Panel access can only use this attack vector if your site allows changing site data from a frontend form (for example user self-registration or the creation of pages from a contact or other frontend form). If you validate or sanitize the provided form data, you are already protected against such attacks by external visitors.
Patches
Kirby 3.5.7 contains patches for the following issues we found during our investigation:
- Some translated error and info messages contain placeholders to dynamically insert information like page titles or filenames. While the translation strings are allowed to contain HTML formatting, the dynamic data needs to be protected against XSS attacks. Kirby 3.5.7 now escapes the dynamic data.
- Our
Boxcomponent used to display information for the user supports HTML output for specific use-cases. We found out that the dialogs used in thefiles,pagesandusersfields as well as thefieldssection used it to display raw exception or error messages. These messages are now escaped. - The users and settings views display user and language data using the
ListItemcomponent that supports HTML. We now escape the dynamic data before it is passed to theListItemcomponent. - Some of our sections and fields support HTML for their
text,helpand/orinfoproperties. This allows custom formatting from the blueprint, but also caused the original issue reported to us that allowed to inject HTML code from the content itself. Kirby 3.5.7 now escapes the defaulttextdisplayed by thefilesandpagessections (filename/page title), thefiles,pagesandusersfields (filename/page title/username) and by query-basedcheckboxes,radio,tagsandmultiselectfields (default text depending on the used query).
Note: Custom text, help and info queries in blueprints are not escaped in 3.5.7. We support HTML in these properties because there are valid use-cases for custom formatting. However there can still be XSS vulnerabilities depending on your use of these properties. In Kirby 3.6 we will provide a new feature that will make it much easier to control whether you want to allow HTML from query placeholders.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | getkirby/cms | all versions | 3.5.7 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for getkirby/cms. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update getkirby/cms to 3.5.7 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-2f2w-349x-vrqm is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-2f2w-349x-vrqm is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-2f2w-349x-vrqm. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-2f2w-349x-vrqm in your dependencies?
O3 detects GHSA-2f2w-349x-vrqm across Packagist dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.