CVE-2025-65012 Overview
CVE-2025-65012 is a stored cross-site scripting (XSS) vulnerability in Kirby, an open-source content management system. The flaw affects Kirby versions 5.0.0 through 5.1.3. Attackers with write access to page titles or usernames can inject malicious strings that execute in the Panel of other authenticated users. The vulnerability triggers when a victim opens the "Changes" dialog, which renders the attacker-controlled title or username without adequate sanitization. Kirby released version 5.1.4 to address the issue. The weakness is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated attackers can execute arbitrary JavaScript in another Panel user's browser session, enabling account takeover or content manipulation within the Kirby admin interface.
Affected Products
- Kirby CMS 5.0.0 through 5.1.3
- Kirby 5 sites permitting external visitors to update page titles or usernames
- Kirby 5 sites with multiple authenticated Panel users
Discovery Timeline
- 2025-11-18 - CVE-2025-65012 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-65012
Vulnerability Analysis
The vulnerability lives in the Kirby Panel's "Changes" dialog, which lists models with unsaved modifications. Attackers first change the title of a page or the name of a user to a payload containing executable markup. They then modify any content field on that same model without saving. The unsaved state marks the model as a candidate for display in the "Changes" dialog. When another authenticated Panel user opens the dialog, the Panel renders the malicious title or username and executes the injected script in that user's browser context.
The exploitation flow requires user interaction from a second Panel user and cannot be automated. Still, any Panel user viewing recent changes is a valid target. Successful execution runs JavaScript with the victim's Panel privileges, which may include content publishing, user management, or configuration changes depending on the victim's role.
Root Cause
The root cause is improper output encoding of user-controlled fields (page titles and user names) when rendered inside the Panel's "Changes" dialog. The Panel treated these values as trusted display strings rather than untrusted input requiring HTML escaping. See the GitHub Security Advisory GHSA-84hf-8gh5-575j for vendor technical details.
Attack Vector
The attack vector is network-based and requires low-privilege authentication or, alternatively, a public workflow that lets external visitors update titles or usernames. The attacker sets a malicious title or username, then dirties a content field on the same model to force it into the "Changes" queue. Payload execution depends on a second Panel user opening the dialog. The vulnerability does not require elevated privileges to plant the payload, but it requires victim interaction to fire.
No verified public proof-of-concept code is available. Refer to the Kirby 5.1.4 release notes for remediation details.
Detection Methods for CVE-2025-65012
Indicators of Compromise
- Page titles or user names containing HTML tags, <script> fragments, or JavaScript event handlers such as onerror= or onload=.
- Unexpected outbound requests originating from Panel user browsers to attacker-controlled domains shortly after opening the Panel.
- Audit log entries showing title or username changes immediately followed by unsaved content edits on the same model.
Detection Strategies
- Review the Kirby content directory and user configuration files for title and name fields containing markup or JavaScript syntax.
- Inspect Panel session activity for anomalous API calls made shortly after a user opened the "Changes" dialog.
- Correlate web server access logs for POST requests to page and user update endpoints from unauthenticated or low-privilege sources.
Monitoring Recommendations
- Enable verbose Panel activity logging and forward events to a centralized logging or SIEM platform for rule-based alerting on suspicious title or name mutations.
- Alert on any title or username field that contains <, >, or javascript: substrings.
- Monitor for role or permission changes performed by administrators shortly after Panel access, which may indicate session hijacking.
How to Mitigate CVE-2025-65012
Immediate Actions Required
- Upgrade all Kirby installations to version 5.1.4 or later without delay.
- Audit existing pages and users for malicious markup in title and name fields, and sanitize any suspicious values before re-enabling Panel access.
- Rotate Panel user sessions and credentials for accounts that may have viewed the "Changes" dialog while affected content was present.
Patch Information
The issue is fixed in Kirby 5.1.4. Download the patched release from the Kirby 5.1.4 GitHub release page. Composer users can update by running composer require getkirby/cms:^5.1.4 in the project root. Verify the deployed version through the Panel or by inspecting kirby/composer.json after the upgrade.
Workarounds
- Restrict Panel access to trusted users only until the upgrade is applied.
- Disable any frontend forms or API endpoints that allow unauthenticated or low-privilege users to modify page titles or usernames.
- Instruct Panel users to avoid opening the "Changes" dialog until the upgrade completes on affected instances.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
