CVE-2017-16807: Getkirby Panel

Medium severity, CVSS 5.4. EPSS: 2.4% chance of exploitation in the next 30 days.

A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file.

Affected products

• Getkirby Panel: before 2.3.3 (fixed in 2.3.3); from 2.4.0, before 2.4.2 (fixed in 2.4.2); from 2.5.0, before 2.5.7 (fixed in 2.5.7)

Published 2017-11-13. Last modified 2026-06-17.