Kirby's Xml::value() method improperly handles input containing CDATA blocks mixed with other structured data before versions 4.9.0 and 5.4.0. This flaw allows XML Injection (CWE-91), also known as Blind XPath Injection, when site or plugin code uses this method to generate XML strings from input data. The vulnerability does not affect Kirby core functionality but can be exploited if the generated XML is processed by systems that interpret the XML schema. The issue is fixed in versions 4.9.0 and 5.4.0 by adding validation that only permits unchanged CDATA passthrough if the entire string consists solely of valid CDATA blocks without additional structured data.

An attacker can inject malicious XML content via crafted input that bypasses the Xml::value() method's escaping mechanism, potentially manipulating downstream XML processing systems. This could lead to altered system behavior if the XML is used in security-sensitive contexts. However, the vulnerability only affects Kirby sites or plugins that generate XML using the vulnerable methods. There are no reports of active exploitation.

Upgrade affected Kirby installations to version 4.9.0 or later, or 5.4.0 or later, where the vulnerability is patched. Sites or plugins not using XML generation via the vulnerable methods are not affected. Since no official remediation level or patch links are provided beyond version updates, applying these version upgrades is the recommended mitigation. Patch status is confirmed by the vendor advisory stating the issue is fixed in these versions.