CVE-2026-49276: Getkirby Kirby

High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days.

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the writer field in any blueprint allowed a scripting link to be included as the target of a link or email link in writer mark components, making the target clickable by the user who entered it and enabling self cross-site scripting in the Panel. This issue is fixed in versions 4.9.4 and 5.4.4.

Affected products

• Getkirby Kirby: before 4.9.4 (fixed in 4.9.4); from 5.0.0, before 5.4.4 (fixed in 5.4.4)

Published 2026-07-09. Last modified 2026-07-10.