medium4.8
CVE-2018-16630
Kirby XSS Vulnerability
Impact
Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | getkirby/kirby | <= 2.5.12 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Getkirby | Kirby | Version 2.5.12 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/security-breachlock/CVE-2018-16630/blob/master/Kirby_Insecure%20file%20validation.pdf
- https://github.com/advisories/GHSA-3gq5-r59m-mmv2
- https://nvd.nist.gov/vuln/detail/CVE-2018-16630
- https://web.archive.org/web/20201208015414/https://github.com/security-breachlock/CVE-2018-16630/blob/master/Kirby_Insecure%20file%20validation.pdf