CVE-2026-44175: Panel stored XSS — UNKNOWN

CISO Take

Kirby CMS fails to sanitize HTML content in list fields and list blocks on save, allowing any authenticated Panel user with update permissions to inject persistent JavaScript that executes in every subsequent visitor's browser — including logged-in admins. With 469 downstream dependents and Kirby commonly used as the content layer for AI product sites and dashboards, a low-privilege contributor account can escalate to full admin access by harvesting session tokens when an administrator browses the compromised frontend. No public exploit or EPSS data is available yet, but stored XSS with automatic admin escalation potential in a production CMS has a well-understood exploitation path requiring minimal attacker sophistication. Patch immediately to Kirby 4.9.1 (4.x branch) or 5.4.1 (5.x branch); if patching is delayed, revoke Panel write access for all non-fully-trusted users and audit existing list field content in content files for unexpected script tags or onerror/onload event handlers.

Sources: GitHub Advisory NVD OpenSSF

What is the risk?

Risk is HIGH for any organization running Kirby CMS as the content management layer for AI-powered products or internal ML dashboards. The attack requires authenticated Panel access — a realistic threat model for multi-author sites, contractors, or insider threats — and yields auto-firing XSS requiring zero victim interaction beyond a normal page visit. Privilege escalation to admin is a well-documented XSS consequence in Panel-driven CMSs. OpenSSF Scorecard of 7.1/10 and six prior CVEs in the same package indicate a maturing but historically vulnerability-prone codebase. No active exploitation evidence reduces immediate urgency slightly, but the simplicity of the exploit and high value of admin credentials on AI product sites elevates practical risk.

How does the attack unfold?

Authenticated Injection

Attacker with a low-privilege Panel account sends a crafted direct API request to Kirby's content update endpoint, embedding malicious JavaScript in a list field value — bypassing the Panel UI's frontend sanitization.

AML.T0049

Payload Persistence

Kirby stores the unsanitized HTML payload directly into the content flat file, persisting the malicious script for every future page render without any additional attacker action.

Victim Execution

An administrator or authenticated user browses any frontend page that renders the compromised list field; the injected JavaScript auto-fires in their browser without requiring any interaction beyond the page load.

AML.T0078

Privilege Escalation

The executed payload exfiltrates the victim's Panel session token to an attacker-controlled server, granting the attacker full administrative access to the CMS and any integrated AI service credentials or configurations.

AML.T0012

Authenticated Injection

Attacker with a low-privilege Panel account sends a crafted direct API request to Kirby's content update endpoint, embedding malicious JavaScript in a list field value — bypassing the Panel UI's frontend sanitization.

AML.T0049

Payload Persistence

Kirby stores the unsanitized HTML payload directly into the content flat file, persisting the malicious script for every future page render without any additional attacker action.

Victim Execution

An administrator or authenticated user browses any frontend page that renders the compromised list field; the injected JavaScript auto-fires in their browser without requiring any interaction beyond the page load.

AML.T0078

Privilege Escalation

The executed payload exfiltrates the victim's Panel session token to an attacker-controlled server, granting the attacker full administrative access to the CMS and any integrated AI service credentials or configurations.

AML.T0012

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Panel	composer	<= 4.9.0	`4.9.1`
5.7K OpenSSF 6.9 502 dependents Pushed 3d ago 66% patched ~15d to patch Full package profile →

Do you use Panel? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.4%

chance of exploitation in 30 days

Higher than 36% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

5 steps

PATCH

Upgrade to Kirby 4.9.1 or 5.4.1 immediately — both releases add backend HTML sanitization to list field save handlers, equivalent to the existing writer field protection.
AUDIT

Search content files (typically under /content/) for list field entries containing <script>, javascript:, onerror=, onload=, or data: URI patterns. Kirby stores content as flat files, making grep-based scanning straightforward.
RESTRICT (if patching is delayed): Remove update permissions from any Panel users who are not fully trusted; consider setting list fields to read-only in blueprints.
DETECT

Enable CSP headers with strict script-src to limit XSS execution scope and generate violation reports for detection.
MONITOR

Review Panel access logs for direct API calls to list field update endpoints from unusual user agents or IPs, which bypass the Panel's frontend sanitization.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass API AML.T0012 - Valid Accounts AML.T0048.001 - Reputational Harm AML.T0049 - Exploit Public-Facing Application AML.T0078 - Drive-by Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.9.6 - Information security measures for AI systems

NIST AI RMF

MANAGE-2.2 - Mechanisms exist to sustain and manage impacts of AI risks

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-44175?

Kirby CMS fails to sanitize HTML content in list fields and list blocks on save, allowing any authenticated Panel user with update permissions to inject persistent JavaScript that executes in every subsequent visitor's browser — including logged-in admins. With 469 downstream dependents and Kirby commonly used as the content layer for AI product sites and dashboards, a low-privilege contributor account can escalate to full admin access by harvesting session tokens when an administrator browses the compromised frontend. No public exploit or EPSS data is available yet, but stored XSS with automatic admin escalation potential in a production CMS has a well-understood exploitation path requiring minimal attacker sophistication. Patch immediately to Kirby 4.9.1 (4.x branch) or 5.4.1 (5.x branch); if patching is delayed, revoke Panel write access for all non-fully-trusted users and audit existing list field content in content files for unexpected script tags or onerror/onload event handlers.

Is CVE-2026-44175 actively exploited?

No confirmed active exploitation of CVE-2026-44175 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-44175?

1. PATCH: Upgrade to Kirby 4.9.1 or 5.4.1 immediately — both releases add backend HTML sanitization to list field save handlers, equivalent to the existing writer field protection. 2. AUDIT: Search content files (typically under /content/) for list field entries containing <script>, javascript:, onerror=, onload=, or data: URI patterns. Kirby stores content as flat files, making grep-based scanning straightforward. 3. RESTRICT (if patching is delayed): Remove update permissions from any Panel users who are not fully trusted; consider setting list fields to read-only in blueprints. 4. DETECT: Enable CSP headers with strict script-src to limit XSS execution scope and generate violation reports for detection. 5. MONITOR: Review Panel access logs for direct API calls to list field update endpoints from unusual user agents or IPs, which bypass the Panel's frontend sanitization.

What systems are affected by CVE-2026-44175?

This vulnerability affects the following AI/ML architecture patterns: CMS-backed AI product sites, ML documentation portals, AI tool landing pages with content management, Internal AI dashboard portals using Kirby as CMS layer.

What is the CVSS score for CVE-2026-44175?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

CMS-backed AI product sitesML documentation portalsAI tool landing pages with content managementInternal AI dashboard portals using Kirby as CMS layer

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0048.001 Reputational Harm

AML.T0049 Exploit Public-Facing Application

AML.T0078 Drive-by Compromise

Compliance Controls Affected

ISO 42001: A.9.6

NIST AI RMF: MANAGE-2.2

OWASP LLM Top 10: LLM02:2025

What are the technical details?

Original Advisory

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, Kirby did not securely sanitize the contents of the list field on save, leaving it vulnerable to cross-site scripting (XSS). Kirby's list field stores its formatted content as HTML, and unlike other field types, its HTML special characters cannot be escaped without losing the formatting. Sanitization was only enforced client-side in the Panel, while the server did not sanitize the content on save. As a result, an attacker could bypass the Panel and send malicious HTML directly to Kirby's API, storing unsanitized markup in the content file. That markup would then be rendered on the site frontend and executed in the browsers of site visitors and logged-in users browsing the site, resulting in persistent XSS. This issue has been fixed in versions 4.9.1 and 5.4.1.

Exploitation Scenario

An attacker with a low-privilege Kirby Panel account — such as an editor or contractor on an AI product documentation site — crafts a direct HTTP request to Kirby's content API containing a list field value with an embedded XSS payload (e.g., a list item with an onerror attribute or inline script). The Panel's frontend editor would sanitize this on normal submission, but the attacker bypasses the UI and calls the API endpoint directly with the raw malicious payload. Kirby stores the unsanitized HTML in the content file. When a site administrator browses any page rendering that list field — such as a feature changelog or FAQ page — the malicious JavaScript auto-fires in their browser, silently exfiltrates the admin's Panel session cookie to an attacker-controlled server, and grants the attacker full administrative access to the CMS, potentially including API key management pages for AI services integrated into the site.

Weaknesses (CWE)

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Primary CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Primary CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.