CVE-2026-32870

{
  "id": "CVE-2026-32870",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-24T01:16:11.953",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kirby is an open-source content management system. Kirby's `Xml::value()` method has special handling for `<![CDATA[ ]]>` blocks. If the input value is already valid `CDATA`, it is not escaped a second time but allowed to pass through. However, prior to versions 4.9.0 and 5.4.0, it was possible to trick this check into allowing values that only contained a valid `CDATA` block but also contained other structured data outside of the `CDATA` block. This structured data would then also be allowed to pass through, circumventing the value protection. The `Xml::value()` method is used in `Xml::tag()`, `Xml::create()` and in the `Xml` data handler (e.g. `Data::encode($string, 'xml')`). Both the vulnerable methods and the data handler are not used in the Kirby core. However they may be used in site or plugin code, e.g. to create XML strings from input data. If those generated files are passed to another implementation that assigns specific meaning to the XML schema, manipulation of this system's behavior is possible. Kirby sites that don't use XML generation in site or plugin code are not affected. The problem has been patched in Kirby 4.9.0 and Kirby 5.4.0. In all of the mentioned releases, Kirby has added additional checks that only allow unchanged `CDATA` passthrough if the entire string is made up of valid `CDATA` blocks and no structured data. This protects all uses of the method against the described vulnerability."
    },
    {
      "lang": "es",
      "value": "Kirby es un sistema de gestión de contenidos de código abierto. El método “Xml::value()” de Kirby tiene un manejo especial para los bloques “<![CDATA[ ]]>”. Si el valor de entrada ya es “CDATA” válido, no se escapa una segunda vez, sino que se permite su paso. Sin embargo, antes de las versiones 4.9.0 y 5.4.0, era posible engañar a esta comprobación para que permitiera valores que solo contenían un bloque “CDATA” válido, pero que también contenían otros datos estructurados fuera del bloque “CDATA”. Estos datos estructurados también se permitirían pasar, eludiendo la protección del valor. El método “Xml::value()” se utiliza en “Xml::tag()”, “Xml::create()” y en el gestor de datos “Xml” (por ejemplo, “Data::encode($string, ’xml’)”). Tanto los métodos vulnerables como el gestor de datos no se utilizan en el núcleo de Kirby. Sin embargo, pueden utilizarse en el código del sitio o del plugin, por ejemplo, para crear cadenas XML a partir de datos de entrada. Si esos archivos generados se pasan a otra implementación que asigna un significado específico al esquema XML, es posible la manipulación del comportamiento de este sistema. Los sitios de Kirby que no utilizan la generación de XML en el código del sitio o del plugin no se ven afectados. El problema ha sido parcheado en Kirby 4.9.0 y Kirby 5.4.0. En todas las versiones mencionadas, Kirby ha añadido comprobaciones adicionales que solo permiten el paso de “CDATA” sin cambios si la cadena completa está compuesta por bloques “CDATA” válidos y no hay datos estructurados. Esto protege todos los usos del método contra la vulnerabilidad descrita."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "getkirby",
          "product": "kirby",
          "versions": [
            {
              "version": "< 4.9.0",
              "status": "affected"
            },
            {
              "version": ">= 5.0.0, < 5.4.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "HIGH",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-24T16:29:59.845471Z",
          "id": "CVE-2026-32870",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-91"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "4.9.0",
              "matchCriteriaId": "1BB5394F-37F9-4A53-9CE7-79548F674886"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.0.0",
              "versionEndExcluding": "5.4.0",
              "matchCriteriaId": "B2D943B9-CD71-45FE-A1A4-158603C3502E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/getkirby/kirby/releases/tag/4.9.0",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/getkirby/kirby/releases/tag/5.4.0",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-9wfj-c55w-j9qr",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}