Kirby CMS improperly neutralizes input during web page generation in its list field prior to versions 4.9.1 and 5.4.1. The list field stores formatted content as HTML, and unlike other fields, its HTML special characters cannot be escaped without losing formatting. Sanitization was only performed client-side in the Panel, not server-side on save. Attackers could bypass the Panel and send malicious HTML directly to Kirby's API, causing persistent cross-site scripting by storing unsanitized markup in content files. This markup is rendered on the frontend, executing in browsers of site visitors and logged-in users. The vulnerability is addressed in versions 4.9.1 and 5.4.1.

An attacker can inject malicious HTML/JavaScript into the list field content that is stored persistently and executed in the browsers of site visitors and logged-in users. This persistent XSS can lead to session hijacking, defacement, or other malicious actions executed in the context of the affected site. The vulnerability affects Kirby CMS installations using vulnerable versions prior to 4.9.1 and 5.4.1.

Upgrade Kirby CMS to version 4.9.1 or later, or 5.4.1 or later, where this vulnerability has been fixed by adding proper server-side sanitization of the list field content on save. No other mitigations are specified. Patch status is not explicitly stated as 'official-fix' but the description confirms the issue is fixed in these versions.